summaryrefslogtreecommitdiffstats
path: root/dom/base/crashtests
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /dom/base/crashtests
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/base/crashtests')
-rw-r--r--dom/base/crashtests/1024428-1.html12
-rw-r--r--dom/base/crashtests/1026714.html16
-rw-r--r--dom/base/crashtests/1027461-1.html9
-rw-r--r--dom/base/crashtests/1027461-inner.xul2
-rw-r--r--dom/base/crashtests/1029710.html11
-rw-r--r--dom/base/crashtests/1118764.html33
-rw-r--r--dom/base/crashtests/1154598.xhtml9
-rw-r--r--dom/base/crashtests/1157995.html9
-rw-r--r--dom/base/crashtests/1158412.html22
-rw-r--r--dom/base/crashtests/116848-1.html30
-rw-r--r--dom/base/crashtests/1181619.html14
-rw-r--r--dom/base/crashtests/1230422.html28
-rw-r--r--dom/base/crashtests/1251361.html33
-rw-r--r--dom/base/crashtests/1304437.html13
-rw-r--r--dom/base/crashtests/1385272-1.html29
-rw-r--r--dom/base/crashtests/149320-1.html16
-rw-r--r--dom/base/crashtests/205225-1.html9
-rw-r--r--dom/base/crashtests/231475-1.html12
-rw-r--r--dom/base/crashtests/244933-1.html13
-rw-r--r--dom/base/crashtests/275912-1.html2
-rw-r--r--dom/base/crashtests/293388-1.html26
-rw-r--r--dom/base/crashtests/308120-1.xul3
-rw-r--r--dom/base/crashtests/324871-1.html14
-rw-r--r--dom/base/crashtests/325730-1.html27
-rw-r--r--dom/base/crashtests/326618-1.html14
-rw-r--r--dom/base/crashtests/326646-1.html22
-rw-r--r--dom/base/crashtests/326778-1.xul11
-rw-r--r--dom/base/crashtests/326865-1.html12
-rw-r--r--dom/base/crashtests/327571-1.html22
-rw-r--r--dom/base/crashtests/327694.html17
-rw-r--r--dom/base/crashtests/327695-1.html10
-rw-r--r--dom/base/crashtests/329481-1.xhtml12
-rw-r--r--dom/base/crashtests/330925-1.xhtml35
-rw-r--r--dom/base/crashtests/336381-1.xhtml29
-rw-r--r--dom/base/crashtests/336715-1.xhtml40
-rw-r--r--dom/base/crashtests/338391-1.xhtml33
-rw-r--r--dom/base/crashtests/338674-1.xhtml36
-rw-r--r--dom/base/crashtests/340733-1.html28
-rw-r--r--dom/base/crashtests/343730-1.xhtml35
-rw-r--r--dom/base/crashtests/343850-1.xhtml28
-rw-r--r--dom/base/crashtests/343889-1.html18
-rw-r--r--dom/base/crashtests/344434-1.xhtml24
-rw-r--r--dom/base/crashtests/344882-1.html33
-rw-r--r--dom/base/crashtests/345837-1.xhtml35
-rw-r--r--dom/base/crashtests/346381-1.html16
-rw-r--r--dom/base/crashtests/348049-1.xhtml40
-rw-r--r--dom/base/crashtests/349355-1.html41
-rw-r--r--dom/base/crashtests/354645-1.xul25
-rw-r--r--dom/base/crashtests/359432-1.xhtml27
-rw-r--r--dom/base/crashtests/360599-1.html25
-rw-r--r--dom/base/crashtests/366200-1.xhtml34
-rw-r--r--dom/base/crashtests/369219-1.xhtml19
-rw-r--r--dom/base/crashtests/369413-1.html12
-rw-r--r--dom/base/crashtests/371124-1-inner.html21
-rw-r--r--dom/base/crashtests/371124-1.html9
-rw-r--r--dom/base/crashtests/371124-2-inner.html10
-rw-r--r--dom/base/crashtests/371124-2.html9
-rw-r--r--dom/base/crashtests/371466-1.xhtml24
-rw-r--r--dom/base/crashtests/372554-1.html22
-rw-r--r--dom/base/crashtests/375399-1-inner.xhtml12
-rw-r--r--dom/base/crashtests/375399-1.html11
-rw-r--r--dom/base/crashtests/377360-1.xhtml19
-rw-r--r--dom/base/crashtests/377960-1.html12
-rw-r--r--dom/base/crashtests/377960-2.html7
-rw-r--r--dom/base/crashtests/384663-1-inner.xul18
-rw-r--r--dom/base/crashtests/384663-1.html9
-rw-r--r--dom/base/crashtests/386000-1.html36
-rw-r--r--dom/base/crashtests/386794-1.html17
-rw-r--r--dom/base/crashtests/387460-1-inner.xhtml22
-rw-r--r--dom/base/crashtests/387460-1.html9
-rw-r--r--dom/base/crashtests/395469-1.xhtml29
-rw-r--r--dom/base/crashtests/395469-2.xhtml45
-rw-r--r--dom/base/crashtests/398088-1.xul23
-rw-r--r--dom/base/crashtests/399712-1.html29
-rw-r--r--dom/base/crashtests/400763-1.html7
-rw-r--r--dom/base/crashtests/401993-1.html38
-rw-r--r--dom/base/crashtests/401993-1.xml1
-rw-r--r--dom/base/crashtests/404869-1.xul23
-rw-r--r--dom/base/crashtests/407818.html5
-rw-r--r--dom/base/crashtests/410860-1.xml8
-rw-r--r--dom/base/crashtests/411882-1.xhtml1
-rw-r--r--dom/base/crashtests/416734-1.html13
-rw-r--r--dom/base/crashtests/417852-1.html13
-rw-r--r--dom/base/crashtests/418928-1.html10
-rw-r--r--dom/base/crashtests/420620-1.html29
-rw-r--r--dom/base/crashtests/424276-1.html17
-rw-r--r--dom/base/crashtests/426987-1.html7
-rw-r--r--dom/base/crashtests/43040-1.html19
-rw-r--r--dom/base/crashtests/439206-1.html19
-rw-r--r--dom/base/crashtests/443538-1.svg7
-rw-r--r--dom/base/crashtests/448615-1.html13
-rw-r--r--dom/base/crashtests/450383-1.html9
-rw-r--r--dom/base/crashtests/450385-1.html11
-rw-r--r--dom/base/crashtests/458637-1-inner.xhtml4
-rw-r--r--dom/base/crashtests/458637-1.html29
-rw-r--r--dom/base/crashtests/462947.html13
-rw-r--r--dom/base/crashtests/467392.html4
-rw-r--r--dom/base/crashtests/472593-1.html7
-rw-r--r--dom/base/crashtests/473284.xul93
-rw-r--r--dom/base/crashtests/474041-1.svg17
-rw-r--r--dom/base/crashtests/476526.html10
-rw-r--r--dom/base/crashtests/483818-1.html14
-rw-r--r--dom/base/crashtests/490760-1.xhtml25
-rw-r--r--dom/base/crashtests/493281-1.html7
-rw-r--r--dom/base/crashtests/493281-2.html12
-rw-r--r--dom/base/crashtests/494810-1.html15
-rw-r--r--dom/base/crashtests/499006-1.html26
-rw-r--r--dom/base/crashtests/499006-2.html35
-rw-r--r--dom/base/crashtests/502617.html13
-rw-r--r--dom/base/crashtests/504224.html22
-rw-r--r--dom/base/crashtests/509536-1.html17
-rw-r--r--dom/base/crashtests/522516-1.html10
-rw-r--r--dom/base/crashtests/529670.html18
-rw-r--r--dom/base/crashtests/535926-1.html28
-rw-r--r--dom/base/crashtests/543645.html14
-rw-r--r--dom/base/crashtests/551631-1.html22
-rw-r--r--dom/base/crashtests/552651.html25
-rw-r--r--dom/base/crashtests/552651.xml2
-rw-r--r--dom/base/crashtests/554230-1.xhtml15
-rw-r--r--dom/base/crashtests/558973.html17
-rw-r--r--dom/base/crashtests/561981-1-iframe.xhtml56
-rw-r--r--dom/base/crashtests/561981-1.html12
-rw-r--r--dom/base/crashtests/561981-2-iframe.xhtml38
-rw-r--r--dom/base/crashtests/561981-2.html12
-rw-r--r--dom/base/crashtests/564079-1.html10
-rw-r--r--dom/base/crashtests/564114.html11
-rw-r--r--dom/base/crashtests/565125-1.html27
-rw-r--r--dom/base/crashtests/575462.svg27
-rw-r--r--dom/base/crashtests/582601.html12
-rw-r--r--dom/base/crashtests/590395-1.html5
-rw-r--r--dom/base/crashtests/593302-1.html29
-rw-r--r--dom/base/crashtests/593302-2.html12
-rw-r--r--dom/base/crashtests/595606-1.html17
-rw-r--r--dom/base/crashtests/595606-2.html18
-rw-r--r--dom/base/crashtests/601247.html8
-rw-r--r--dom/base/crashtests/603531.html18
-rw-r--r--dom/base/crashtests/604262-1.html8
-rw-r--r--dom/base/crashtests/605672-1.svg17
-rw-r--r--dom/base/crashtests/606729-1.html1
-rw-r--r--dom/base/crashtests/609560-1.xhtml31
-rw-r--r--dom/base/crashtests/610571-1.html26
-rw-r--r--dom/base/crashtests/612018-1.html21
-rw-r--r--dom/base/crashtests/628599-1.html31
-rw-r--r--dom/base/crashtests/637116.html29
-rw-r--r--dom/base/crashtests/637214-1.svg26
-rw-r--r--dom/base/crashtests/637214-2.svg26
-rw-r--r--dom/base/crashtests/642022-1.html4
-rw-r--r--dom/base/crashtests/646184.html17
-rw-r--r--dom/base/crashtests/658845-1.svg3
-rw-r--r--dom/base/crashtests/666869.html17
-rw-r--r--dom/base/crashtests/667336-1.html4
-rw-r--r--dom/base/crashtests/675621-1.html7
-rw-r--r--dom/base/crashtests/677194.html6
-rw-r--r--dom/base/crashtests/679459.html21
-rw-r--r--dom/base/crashtests/679689-1.html2
-rw-r--r--dom/base/crashtests/682463.html20
-rw-r--r--dom/base/crashtests/693212.xhtml16
-rw-r--r--dom/base/crashtests/693811-1.html14
-rw-r--r--dom/base/crashtests/693811-2.html16
-rw-r--r--dom/base/crashtests/693811-3.html4
-rw-r--r--dom/base/crashtests/693894.html8
-rw-r--r--dom/base/crashtests/695867.html9
-rw-r--r--dom/base/crashtests/697643.html5
-rw-r--r--dom/base/crashtests/698974-1.html4
-rw-r--r--dom/base/crashtests/700090-1.html32
-rw-r--r--dom/base/crashtests/700090-2.html29
-rw-r--r--dom/base/crashtests/700512-worker.js7
-rw-r--r--dom/base/crashtests/700512.html11
-rw-r--r--dom/base/crashtests/706283-1.html6
-rw-r--r--dom/base/crashtests/709384.html5
-rw-r--r--dom/base/crashtests/709954.html21
-rw-r--r--dom/base/crashtests/713417-1.html23
-rw-r--r--dom/base/crashtests/713417-2.html26
-rw-r--r--dom/base/crashtests/715056.html21
-rw-r--r--dom/base/crashtests/729431-1.xhtml36
-rw-r--r--dom/base/crashtests/741163-1.html7
-rw-r--r--dom/base/crashtests/745495.html19
-rw-r--r--dom/base/crashtests/752226-1.html4
-rw-r--r--dom/base/crashtests/752226-2.html4
-rw-r--r--dom/base/crashtests/766426.html32
-rw-r--r--dom/base/crashtests/771639.html16
-rw-r--r--dom/base/crashtests/786854.html4
-rw-r--r--dom/base/crashtests/815043.html8
-rw-r--r--dom/base/crashtests/815276.html6
-rw-r--r--dom/base/crashtests/815477.html15
-rw-r--r--dom/base/crashtests/815500.html14
-rw-r--r--dom/base/crashtests/816253.html31
-rw-r--r--dom/base/crashtests/819014.html22
-rw-r--r--dom/base/crashtests/822691.html21
-rw-r--r--dom/base/crashtests/822723.html20
-rw-r--r--dom/base/crashtests/824719.html26
-rw-r--r--dom/base/crashtests/827190.html13
-rw-r--r--dom/base/crashtests/828054.html19
-rw-r--r--dom/base/crashtests/828903-iframe.html46
-rw-r--r--dom/base/crashtests/828903.html28
-rw-r--r--dom/base/crashtests/829428.html8
-rw-r--r--dom/base/crashtests/830098.html14
-rw-r--r--dom/base/crashtests/831287.html11
-rw-r--r--dom/base/crashtests/832644.html8
-rw-r--r--dom/base/crashtests/836890.html19
-rw-r--r--dom/base/crashtests/838489-1.html11
-rw-r--r--dom/base/crashtests/838489-2.html16
-rw-r--r--dom/base/crashtests/841205.html25
-rw-r--r--dom/base/crashtests/844404.html23
-rw-r--r--dom/base/crashtests/845093-1.html10
-rw-r--r--dom/base/crashtests/845093-2.html7
-rw-r--r--dom/base/crashtests/847127.html19
-rw-r--r--dom/base/crashtests/849601.html38
-rw-r--r--dom/base/crashtests/849727.html9
-rw-r--r--dom/base/crashtests/849732.html18
-rw-r--r--dom/base/crashtests/851353-1.html25
-rw-r--r--dom/base/crashtests/852381.html19
-rw-r--r--dom/base/crashtests/863950.html18
-rw-r--r--dom/base/crashtests/864448.html22
-rw-r--r--dom/base/crashtests/886213.html22
-rw-r--r--dom/base/crashtests/898906.html14
-rw-r--r--dom/base/crashtests/90613-1.html7
-rw-r--r--dom/base/crashtests/930250.html8
-rw-r--r--dom/base/crashtests/942979.html42
-rw-r--r--dom/base/crashtests/973401.html20
-rw-r--r--dom/base/crashtests/978646.html15
-rw-r--r--dom/base/crashtests/crashtests.list211
-rw-r--r--dom/base/crashtests/structured_clone_container_throws.html9
-rw-r--r--dom/base/crashtests/xhr_abortinprogress.html23
-rw-r--r--dom/base/crashtests/xhr_empty_datauri.html5
-rw-r--r--dom/base/crashtests/xhr_html_nullresponse.html5
226 files changed, 4260 insertions, 0 deletions
diff --git a/dom/base/crashtests/1024428-1.html b/dom/base/crashtests/1024428-1.html
new file mode 100644
index 000000000..ce181c8af
--- /dev/null
+++ b/dom/base/crashtests/1024428-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div id="host"></div>
+<script>
+var s = host.createShadowRoot();
+s.innerHTML = '<input type="range" />';
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1026714.html b/dom/base/crashtests/1026714.html
new file mode 100644
index 000000000..465d62942
--- /dev/null
+++ b/dom/base/crashtests/1026714.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<body onload="f()">
+ <div></div>
+ <style>
+ div { color: blue; }
+ </style>
+ <script>
+ function f() {
+ // This should not leak.
+ var div = document.querySelector("div");
+ var shadow = div.createShadowRoot();
+ shadow.innerHTML = '<div><style scoped>p { color: green; }</style>';
+ }
+ </script>
+</body>
diff --git a/dom/base/crashtests/1027461-1.html b/dom/base/crashtests/1027461-1.html
new file mode 100644
index 000000000..3117a5e3c
--- /dev/null
+++ b/dom/base/crashtests/1027461-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta charset="UTF-8">
+ <link rel="import" href="1027461-inner.xul">
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/dom/base/crashtests/1027461-inner.xul b/dom/base/crashtests/1027461-inner.xul
new file mode 100644
index 000000000..84ee2d222
--- /dev/null
+++ b/dom/base/crashtests/1027461-inner.xul
@@ -0,0 +1,2 @@
+<?xml?>
+<empty-xul-file />
diff --git a/dom/base/crashtests/1029710.html b/dom/base/crashtests/1029710.html
new file mode 100644
index 000000000..b6bda3f26
--- /dev/null
+++ b/dom/base/crashtests/1029710.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+ var x = document.createElement('span');
+ x.createShadowRoot();
+ x.id = 'a';
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/1118764.html b/dom/base/crashtests/1118764.html
new file mode 100644
index 000000000..54a4d94b6
--- /dev/null
+++ b/dom/base/crashtests/1118764.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+#foo {
+ overflow: scroll;
+ height: 100px;
+}
+</style>
+<div id="foo">
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+Mozilla Firefox<br>
+<script>
+foo.createShadowRoot().innerHTML = "<content></content>";
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1154598.xhtml b/dom/base/crashtests/1154598.xhtml
new file mode 100644
index 000000000..64d550654
--- /dev/null
+++ b/dom/base/crashtests/1154598.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body><body>
+<script>
+s = document.createElement('script');
+s.src="";
+document.body.appendChild(s);
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1157995.html b/dom/base/crashtests/1157995.html
new file mode 100644
index 000000000..5d822c0a6
--- /dev/null
+++ b/dom/base/crashtests/1157995.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <script>
+ // This should not leak.
+ var a = navigator;
+ navigator.mediaDevices._ = null;
+ </script>
+</body>
diff --git a/dom/base/crashtests/1158412.html b/dom/base/crashtests/1158412.html
new file mode 100644
index 000000000..e62fce1ab
--- /dev/null
+++ b/dom/base/crashtests/1158412.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.styleSheetSets.expando = null;
+ var otherDoc = document.implementation.createDocument("", "", null);
+ var otherSpan = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "span");
+
+ var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
+ img.srcset = "data:,a 1w, data:,b 1w";
+ img.sizes = "1px";
+ otherSpan.appendChild(img);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/116848-1.html b/dom/base/crashtests/116848-1.html
new file mode 100644
index 000000000..785d97fe6
--- /dev/null
+++ b/dom/base/crashtests/116848-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+ <title>Test case boiled down from www.sjetmarka.no</title>
+</head>
+<body>
+ <table>
+ <tr>
+ <td>
+ <SCRIPT language="JavaScript1.2">
+ document.write('<div>')
+ </script>
+ Hei og velkommen til Mozilla
+ <head>
+ <script language="JavaScript1.2">
+ document.write('</div>')
+ </script>
+ </head>
+ </td>
+ </tr>
+ </table>
+ <table>
+ <tr>
+ <td>
+ God jul til alle
+ </td>
+ </tr>
+ </table>
+</body>
+</html>
diff --git a/dom/base/crashtests/1181619.html b/dom/base/crashtests/1181619.html
new file mode 100644
index 000000000..929207964
--- /dev/null
+++ b/dom/base/crashtests/1181619.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+ <script>
+ var obs = new MutationObserver(function() {
+ // Just need something here to assert exception is not pending. Any
+ // binding method will do.
+ console.log("hello");
+ });
+ obs.observe(document.body, { childList: true });
+ </script>
+ <script>
+ noSuchMethodYo();
+ </script>
+</body>
diff --git a/dom/base/crashtests/1230422.html b/dom/base/crashtests/1230422.html
new file mode 100644
index 000000000..fbaa63d38
--- /dev/null
+++ b/dom/base/crashtests/1230422.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<script>
+
+var a = new FileReader();
+
+function f() {
+ a.removeEventListener("loadend", f);
+ g();
+}
+
+function g() {
+ a.readAsBinaryString(new Blob());
+}
+
+a.addEventListener("loadend", f);
+
+try {
+ g();
+ g();
+} catch(e) {}
+
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1251361.html b/dom/base/crashtests/1251361.html
new file mode 100644
index 000000000..57c76121f
--- /dev/null
+++ b/dom/base/crashtests/1251361.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var frameRoot;
+
+function boom()
+{
+ var frameWin = f.contentWindow;
+ frameRoot = frameWin.document.documentElement;
+ frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
+}
+
+function g()
+{
+ setTimeout(h, 0);
+}
+
+function h()
+{
+ var newDoc = document.implementation.createDocument('', '', null);
+ newDoc.adoptNode(frameRoot);
+}
+
+</script>
+<body onload="boom();">
+
+<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/1304437.html b/dom/base/crashtests/1304437.html
new file mode 100644
index 000000000..a4e9d5110
--- /dev/null
+++ b/dom/base/crashtests/1304437.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var e=document.createElement("q");
+ document.documentElement.appendChild(e);
+ e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=),url(data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==)";
+ setTimeout(function(){
+ e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=)";
+ },0);
+};
+</script>
+</html>
diff --git a/dom/base/crashtests/1385272-1.html b/dom/base/crashtests/1385272-1.html
new file mode 100644
index 000000000..5bdd40799
--- /dev/null
+++ b/dom/base/crashtests/1385272-1.html
@@ -0,0 +1,29 @@
+<html>
+ <head>
+ <script>
+ try { o1 = document.createElement("tr") } catch(e) { }
+ try { o2 = document.createElement("td") } catch(e) { }
+ try { o3 = document.createElement("tr") } catch(e) { }
+ try { o4 = document.createElement("div") } catch(e) { }
+ try { o5 = document.createElement("input") } catch(e) { }
+ try { o6 = document.createElement('map') } catch(e) { }
+ try { o7 = document.createElement('select') } catch(e) { }
+ try { o8 = document.createElement("canvas") } catch(e) { }
+ try { o9 = document.createElement("area") } catch(e) { };
+ try { o1.appendChild(o2) } catch(e) { }
+ try { document.documentElement.appendChild(o3) } catch(e) { }
+ try { document.documentElement.appendChild(o4) } catch(e) { }
+ try { document.documentElement.appendChild(o6) } catch(e) { }
+ try { o3.appendChild(o7) } catch(e) { }
+ try { o4.appendChild(o8) } catch(e) { }
+ try { o3.appendChild(o5); } catch(e) { }
+ try { o3.appendChild(o1); } catch(e) { }
+ try { o6.contentEditable = "true" } catch(e) { };
+ try { o6.offsetHeight } catch(e) { };
+ try { o4.appendChild(o9) } catch(e) { };
+ try { o2.insertAdjacentHTML("beforeBegin", "<button id='id0'></button>\n"); } catch(e) { }
+ try { document.replaceChild(document.documentElement, document.documentElement); } catch(e) { }
+ try { document.execCommand("selectall",false,null) } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/dom/base/crashtests/149320-1.html b/dom/base/crashtests/149320-1.html
new file mode 100644
index 000000000..d09b2c5ad
--- /dev/null
+++ b/dom/base/crashtests/149320-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+</head>
+<body>
+<div>Selection is HERE only</div>
+<script type="text/javascript">
+ selectedNode = document.getElementsByTagName("div").item(0);
+ testRange = document.createRange();
+
+ testRange.setStart(selectedNode, 13);
+ testRange.setEnd(selectedNode, 17);
+
+ document.body.appendChild(document.createTextNode("Text of Range: "+testRange));
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/205225-1.html b/dom/base/crashtests/205225-1.html
new file mode 100644
index 000000000..26576d4d5
--- /dev/null
+++ b/dom/base/crashtests/205225-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<script type="text/javascript">
+document.createTreeWalker(null, NodeFilter.SHOW_ALL, null);
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/231475-1.html b/dom/base/crashtests/231475-1.html
new file mode 100644
index 000000000..4a0d997da
--- /dev/null
+++ b/dom/base/crashtests/231475-1.html
@@ -0,0 +1,12 @@
+<html><body>
+<script type="text/javascript">
+//function doBold(){
+range = document.createRange();
+newNode = document.createElement("b");
+range.selectNodeContents(document);
+
+range.surroundContents(newNode)
+//}
+</script>
+text
+</body></html> \ No newline at end of file
diff --git a/dom/base/crashtests/244933-1.html b/dom/base/crashtests/244933-1.html
new file mode 100644
index 000000000..7eaf96cc3
--- /dev/null
+++ b/dom/base/crashtests/244933-1.html
@@ -0,0 +1,13 @@
+<html>
+<body>
+<pre>
+<script>
+document.write(window.sidebar.something);
+for (i in window.sidebar)
+{
+ break
+}
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/base/crashtests/275912-1.html b/dom/base/crashtests/275912-1.html
new file mode 100644
index 000000000..08b5bc5fc
--- /dev/null
+++ b/dom/base/crashtests/275912-1.html
@@ -0,0 +1,2 @@
+<HTML>
+><><BODY onLoad=*>< \ No newline at end of file
diff --git a/dom/base/crashtests/293388-1.html b/dom/base/crashtests/293388-1.html
new file mode 100644
index 000000000..ae1804076
--- /dev/null
+++ b/dom/base/crashtests/293388-1.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait"><head><title>Testcase bug 293388 - Overwriting of div innerHTML cause starting of the loading icon(circle) and some times browser can crash [@ nsRange::DeleteContents]</title></head>
+<script>
+function reallyClear()
+{
+ var par = document.getElementById("par");
+ var range = document.createRange();
+ range.selectNodeContents(par);
+ range.deleteContents();
+ document.documentElement.removeAttribute("class");
+}
+
+function clear()
+{
+ document.body.removeEventListener("DOMNodeRemoved", clear, false);
+ reallyClear();
+}
+
+function init()
+{
+ document.body.addEventListener("DOMNodeRemoved", clear, false);
+}
+
+</script>
+<body onload="init(); setTimeout(reallyClear, 10);">
+<div id="par"><span>1</span><span>2</span></div>
+</body></html> \ No newline at end of file
diff --git a/dom/base/crashtests/308120-1.xul b/dom/base/crashtests/308120-1.xul
new file mode 100644
index 000000000..55963d758
--- /dev/null
+++ b/dom/base/crashtests/308120-1.xul
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="var button=document.getElementsByTagName('button')[0]; try { button.appendChild(SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(button))[0]); } catch(e) { }">
+ <button/>
+</window>
diff --git a/dom/base/crashtests/324871-1.html b/dom/base/crashtests/324871-1.html
new file mode 100644
index 000000000..21aa46230
--- /dev/null
+++ b/dom/base/crashtests/324871-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+function loaded() {
+ var node = document;
+ var handler = function(operation, key, data, src, dst) { alert(data); };
+ node.setUserData("foo", "data", handler);
+}
+</script>
+</head>
+<body onload="loaded();">
+<div id="elem"></div>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/325730-1.html b/dom/base/crashtests/325730-1.html
new file mode 100644
index 000000000..bcc1f462e
--- /dev/null
+++ b/dom/base/crashtests/325730-1.html
@@ -0,0 +1,27 @@
+<html>
+
+<head>
+
+<script>
+
+function init()
+{
+ document.addEventListener("DOMNodeRemoved", meep, false);
+ document.body.appendChild(document.getElementById("b"));
+
+ function meep()
+ {
+ document.removeEventListener("DOMNodeRemoved", meep, false);
+ document.body.removeChild(document.getElementById("c"));
+ }
+}
+
+window.addEventListener("load", init, false);
+
+
+</script>
+
+</head>
+
+<body><div id="b"></div><div id="c"></div></body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/326618-1.html b/dom/base/crashtests/326618-1.html
new file mode 100644
index 000000000..926670ab6
--- /dev/null
+++ b/dom/base/crashtests/326618-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+<body>
+<script>
+
+try {
+ document.body.removeChild(function(){});
+} catch (e) {
+}
+
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/326646-1.html b/dom/base/crashtests/326646-1.html
new file mode 100644
index 000000000..5b654dd02
--- /dev/null
+++ b/dom/base/crashtests/326646-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+
+<script>
+
+var dt;
+
+function init() {
+ dt = document.implementation.createDocumentType("rheet", 0, 2);
+ dt.foopy = "quux";
+}
+
+init();
+
+</script>
+
+</head>
+
+<body>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/326778-1.xul b/dom/base/crashtests/326778-1.xul
new file mode 100644
index 000000000..ea235730a
--- /dev/null
+++ b/dom/base/crashtests/326778-1.xul
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script>
+<![CDATA[
+try {
+ document.getBoxObjectFor({});
+} catch(e) { }
+]]>
+</script>
+</window>
diff --git a/dom/base/crashtests/326865-1.html b/dom/base/crashtests/326865-1.html
new file mode 100644
index 000000000..2450e65a6
--- /dev/null
+++ b/dom/base/crashtests/326865-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+try {
+ window.getComputedStyle(null, null);
+} catch (e) {
+}
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/327571-1.html b/dom/base/crashtests/327571-1.html
new file mode 100644
index 000000000..117f09351
--- /dev/null
+++ b/dom/base/crashtests/327571-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function init()
+{
+
+ var x = document.getElementById("d");
+ x.__proto__ = document.getElementById("f");
+ x.inputname;
+}
+
+</script>
+</head>
+
+<body onload="init();">
+
+<div id="d"></div>
+<form id="f"><input name="inputname"></form>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/327694.html b/dom/base/crashtests/327694.html
new file mode 100644
index 000000000..daff350fa
--- /dev/null
+++ b/dom/base/crashtests/327694.html
@@ -0,0 +1,17 @@
+<html> <head>
+
+<script>
+
+function init()
+{
+ var y = document.getElementById("tt");
+ var z = y.firstChild;
+ y.removeChild(z);
+ z.text;
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+ </head> <body> <div id="tt"><a href="http://www.mozilla.org">Foo</a></div>
+ </body> </html>
diff --git a/dom/base/crashtests/327695-1.html b/dom/base/crashtests/327695-1.html
new file mode 100644
index 000000000..a3d5562b3
--- /dev/null
+++ b/dom/base/crashtests/327695-1.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<script>
+document.createTextNode("").__proto__.__proto__ = null;
+document.createTextNode("");
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/329481-1.xhtml b/dom/base/crashtests/329481-1.xhtml
new file mode 100644
index 000000000..3ba5477f3
--- /dev/null
+++ b/dom/base/crashtests/329481-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>This page made Firefox leak domwindows and documents.</p>
+<span onmouseover="1"></span>
+<script>
+try {
+ window.__proto__ = document.createElement("div");
+} catch(e) {
+}
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/330925-1.xhtml b/dom/base/crashtests/330925-1.xhtml
new file mode 100644
index 000000000..7dac8374c
--- /dev/null
+++ b/dom/base/crashtests/330925-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+
+<script>
+
+function init()
+{
+ var foopy = document.getElementById("foopy");
+ var emb = document.getElementById("emb");
+
+ try {
+ foopy.appendChild(SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(emb))[0]);
+ emb.parentNode.removeChild(emb);
+ foopy.parentNode.removeChild(foopy);
+ } catch (e) {
+ }
+
+ document.documentElement.removeAttribute("class");
+}
+
+
+window.addEventListener("load", function() { setTimeout(init, 30); }, false);
+
+</script>
+
+</head>
+<body>
+
+<div id="foopy"/>
+
+<embed src="data:foo/bar,baz" id="emb" />
+
+</body>
+</html>
diff --git a/dom/base/crashtests/336381-1.xhtml b/dom/base/crashtests/336381-1.xhtml
new file mode 100644
index 000000000..eac3eeb57
--- /dev/null
+++ b/dom/base/crashtests/336381-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ var zz = document.getElementById("d").childNodes[0];
+
+ zz.parentNode.removeChild(zz);
+
+ var r = document.createRange();
+ r.setStart(zz, 0);
+ r.setEnd(zz, 0);
+
+ try {
+ r.insertNode(document.createTextNode('5'));
+ } catch (e) {
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div id="d">3</div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/336715-1.xhtml b/dom/base/crashtests/336715-1.xhtml
new file mode 100644
index 000000000..ad9d1430a
--- /dev/null
+++ b/dom/base/crashtests/336715-1.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function funn()
+{
+ var q = document.getElementById("q");
+
+ var start1 = document.getElementById("start1");
+ var end1 = document.getElementById("end1");
+
+ var start2 = q; // div
+ var end2 = q.previousSibling; // text node
+
+ var r = document.createRange();
+ r.setStart(start1, 0);
+ r.setEnd(end1, 0);
+ r.deleteContents();
+
+ // the offsets for start2 and end2 must be the same to trigger the assertion
+ var s = document.createRange();
+ s.setStart(start2, 0);
+ s.setEnd(end2, 0);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(funn, 30)">
+ <div id="start1"></div>
+ <div id="t">X<div id="q">Y</div></div>
+ <div id="end1"></div>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/338391-1.xhtml b/dom/base/crashtests/338391-1.xhtml
new file mode 100644
index 000000000..9366e0c0f
--- /dev/null
+++ b/dom/base/crashtests/338391-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+ var n = document.getElementById("n");
+
+ document.addEventListener("DOMNodeRemoved", foozle, false);
+ n.parentNode.removeChild(n);
+ document.removeEventListener("DOMNodeRemoved", foozle, false);
+
+ function foozle()
+ {
+ document.removeEventListener("DOMNodeRemoved", foozle, false); // prevent accidental recursion
+
+ n.parentNode.removeChild(n);
+
+ document.documentElement.removeAttribute("class");
+ }
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<div id="n"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/338674-1.xhtml b/dom/base/crashtests/338674-1.xhtml
new file mode 100644
index 000000000..2cba227dc
--- /dev/null
+++ b/dom/base/crashtests/338674-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+ var s = document.getElementById("s")
+ var t = s.previousSibling; // a whitespace text node..
+
+ document.addEventListener("DOMAttrModified", bang, false);
+ rM(s);
+ document.removeEventListener("DOMAttrModified", bang, false);
+
+ function bang(ev) {
+ document.removeEventListener("DOMAttrModified", bang, false); // avoid accidental recursion, multiple calls, etc.
+ rM(t);
+ }
+
+ document.documentElement.removeAttribute("class");
+}
+
+function rM(n) { n.parentNode.removeChild(n); }
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 1);">
+
+<div><select><option>C</option></select></div>
+
+<span id="s">A <div>B</div></span>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/340733-1.html b/dom/base/crashtests/340733-1.html
new file mode 100644
index 000000000..26d8fb9cd
--- /dev/null
+++ b/dom/base/crashtests/340733-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+
+<head>
+<script type="text/javascript">
+
+
+function boom()
+{
+ var map = document.getElementById("map");
+ var table = document.getElementById("table");
+
+ map.appendChild(table);
+ map.childNodes[0].appendChild(document.createTextNode(' '));
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<img src="../../../testing/crashtest/images/tree.gif" usemap="#map">
+<map name="map" id="map"><area></map>
+<table aardvark="aardvark" id="table"><tbody><tr><td>Table</td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/343730-1.xhtml b/dom/base/crashtests/343730-1.xhtml
new file mode 100644
index 000000000..82b5a26a8
--- /dev/null
+++ b/dom/base/crashtests/343730-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+<![CDATA[
+
+var div;
+
+function boo()
+{
+ var newSpan = document.createElement('span');
+ div = document.getElementById('div');
+
+ var newScript = document.createElement('script');
+ var nt = document.createTextNode("document.body.removeChild(div);");
+ newScript.appendChild(nt);
+ newSpan.appendChild(newScript);
+
+ div.appendChild(newSpan);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(boo, 30);">
+
+<div id="div"></div>
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/343850-1.xhtml b/dom/base/crashtests/343850-1.xhtml
new file mode 100644
index 000000000..4bf313062
--- /dev/null
+++ b/dom/base/crashtests/343850-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+<![CDATA[
+
+function boom()
+{
+ var div = document.getElementById("div");
+ var embed = document.getElementById("embed");
+ embed.setAttribute("src", "javascript:'QQQQ'");
+ embed.removeAttribute("src");
+ document.body.appendChild(div);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div id="div"><embed id="embed"/></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/343889-1.html b/dom/base/crashtests/343889-1.html
new file mode 100644
index 000000000..8ea8bc28d
--- /dev/null
+++ b/dom/base/crashtests/343889-1.html
@@ -0,0 +1,18 @@
+<Html class="reftest-wait">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf8">
+</head>
+<body onload="boom()">
+<iframe src="#" id="data"></iframe>
+<script>
+function boom() {
+var d=document.getElementById('data').contentDocument;
+d.clear()
+var text='Тест';
+d.write(text);
+d.close();
+document.documentElement.removeAttribute("class");
+}
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/344434-1.xhtml b/dom/base/crashtests/344434-1.xhtml
new file mode 100644
index 000000000..28c5fc0e4
--- /dev/null
+++ b/dom/base/crashtests/344434-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+var XUL_NS = 'http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul';
+
+function foopy()
+{
+ document.getElementsByTagName("div")[0].appendChild(document.createElement("div"));
+ document.body.appendChild(document.createElementNS(XUL_NS, "toolbarpalette"))
+ document.body.appendChild(document.createElementNS(XUL_NS, "toolbar"))
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foopy, 30);">
+ <div>A</div>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/344882-1.html b/dom/base/crashtests/344882-1.html
new file mode 100644
index 000000000..6a8dd69d5
--- /dev/null
+++ b/dom/base/crashtests/344882-1.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+<script>
+var obj;
+
+function boo()
+{
+ obj = document.getElementById("obj");
+ setScriptSrc();
+}
+
+function setScriptSrc()
+{
+ obj.data = "javascript:setScriptSrc2();";
+}
+
+function setScriptSrc2()
+{
+ obj.data = "javascript:void 0";
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boo, 30);">
+
+<object data="../../../testing/crashtest/images/tree.gif" id="obj">
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/345837-1.xhtml b/dom/base/crashtests/345837-1.xhtml
new file mode 100644
index 000000000..017bac1e9
--- /dev/null
+++ b/dom/base/crashtests/345837-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+<![CDATA[
+
+function foo()
+{
+ var r = document.createRange();
+ r.setStart(document.getElementById("a"), 0);
+ r.setEnd(document.getElementById("b"), 0);
+ window.getSelection().addRange(r);
+
+ var everything = document.getElementById("everything");
+ everything.parentNode.removeChild(everything);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(foo, 30);">
+
+<div id="everything">
+
+<div id="a">
+ <span id="b" />
+</div>
+
+</div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/346381-1.html b/dom/base/crashtests/346381-1.html
new file mode 100644
index 000000000..4d0263d80
--- /dev/null
+++ b/dom/base/crashtests/346381-1.html
@@ -0,0 +1,16 @@
+<html>
+
+<head>
+</head>
+
+<body onload="window.zoop = document.getElementById('paz');">
+
+<p>Loading this page should not make Firefox leak DOMWindows or documents.</p>
+
+<div id="paz">
+<span onmouseover="6"></span>
+</div>
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/348049-1.xhtml b/dom/base/crashtests/348049-1.xhtml
new file mode 100644
index 000000000..d8f5790d2
--- /dev/null
+++ b/dom/base/crashtests/348049-1.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="td">
+ <content>
+ <html:td><children/></html:td>
+ </content>
+</binding>
+
+<binding id="foo">
+ <content>
+ <html:span/>
+ </content>
+</binding>
+
+</bindings>
+
+
+<script>
+function f1()
+{
+ document.getElementById("inner").style.MozBinding = "url(#foo)";
+ document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+
+
+<body onload="setTimeout(f1, 30);">
+
+
+<div id="outer" style="-moz-binding: url(#td)"><div id="inner">M</div></div>
+
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/349355-1.html b/dom/base/crashtests/349355-1.html
new file mode 100644
index 000000000..b79387118
--- /dev/null
+++ b/dom/base/crashtests/349355-1.html
@@ -0,0 +1,41 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function zap()
+{
+ var j = document.getElementById("j");
+ j.parentNode.removeChild(j);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+<body onload="setTimeout(zap, 1);">
+
+
+<div>
+
+ <form>
+ <fieldset>
+ <div id="j">
+ <div>
+ <div>
+ <span>
+ <input type="submit">
+ <label></label>
+ </span>
+ </div>
+ </div>
+
+ </div>
+ </fieldset>
+ </form>
+
+</div>
+
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/354645-1.xul b/dom/base/crashtests/354645-1.xul
new file mode 100644
index 000000000..3e3670ee0
--- /dev/null
+++ b/dom/base/crashtests/354645-1.xul
@@ -0,0 +1,25 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
+
+<script type="text/javascript">
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+ var A = document.getElementById("A");
+ var B = document.createElementNS(XUL_NS, "tabs");
+ var C = document.createElementNS(XUL_NS, "hbox");
+ B.appendChild(C);
+ A.appendChild(B);
+}
+
+function remove(n)
+{
+ n.parentNode.removeChild(n);
+}
+
+</script>
+
+<hbox id="A" onselect="remove(event.originalTarget); document.documentElement.removeAttribute('class');"></hbox>
+
+</window>
diff --git a/dom/base/crashtests/359432-1.xhtml b/dom/base/crashtests/359432-1.xhtml
new file mode 100644
index 000000000..391a4d162
--- /dev/null
+++ b/dom/base/crashtests/359432-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ class="reftest-wait">
+
+<head>
+
+<script>
+
+function boo()
+{
+ var tabbox = document.getElementById("tabbox");
+ document.body.removeChild(tabbox);
+ tabbox.setAttribute("context", "a");
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boo, 30)">
+
+<xul:tabbox id="tabbox" />
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/360599-1.html b/dom/base/crashtests/360599-1.html
new file mode 100644
index 000000000..c090088c0
--- /dev/null
+++ b/dom/base/crashtests/360599-1.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+#b::first-letter { }
+#c::first-line { }
+</style>
+<title>Testcase bug 360599 - Crash [@ nsFrameList::DestroyFrames] with first-letter/first-line css and position: fixed</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div id="c">
+ <table>
+ <div id="b" style="display:table-header-group;">
+ <q>
+ text
+ <div style="position:fixed;">
+ <q>y</q>
+ </div>
+ </q>
+ </div>
+ <span style="display: table;"></span>
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/366200-1.xhtml b/dom/base/crashtests/366200-1.xhtml
new file mode 100644
index 000000000..7845f0bdf
--- /dev/null
+++ b/dom/base/crashtests/366200-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script type="text/javascript">
+
+<![CDATA[
+
+function boom()
+{
+ var dE = document.documentElement;
+ var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+
+ document.addEventListener("DOMNodeRemoved", whee, false);
+ document.removeChild(dE);
+ document.removeEventListener("DOMNodeRemoved", whee, false);
+
+ function whee()
+ {
+ document.removeEventListener("DOMNodeRemoved", whee, false);
+ document.insertBefore(newSpan, dE);
+ }
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+
+</script>
+</head>
+
+<body>
+<p>This text will disappear. There should be no assertions.</p>
+</body>
+</html>
diff --git a/dom/base/crashtests/369219-1.xhtml b/dom/base/crashtests/369219-1.xhtml
new file mode 100644
index 000000000..b44242d26
--- /dev/null
+++ b/dom/base/crashtests/369219-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ var select = document.getElementById("sss");
+ select.options.add.call(null, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<select id="sss"><option>foo</option></select>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/369413-1.html b/dom/base/crashtests/369413-1.html
new file mode 100644
index 000000000..4fc3b7dfc
--- /dev/null
+++ b/dom/base/crashtests/369413-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+try { atob(null); } catch(e) { }
+try { atob(""); } catch(e) { }
+try { atob("A="); } catch(e) { }
+try { atob("AA="); } catch(e) { }
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/371124-1-inner.html b/dom/base/crashtests/371124-1-inner.html
new file mode 100644
index 000000000..d8fb45519
--- /dev/null
+++ b/dom/base/crashtests/371124-1-inner.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ obj = document.getElementsByTagName("object")[0];
+ obj.__proto__ = null;
+ for (p in obj)
+ dump(p + "\n");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 200);">
+
+<object></object>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/371124-1.html b/dom/base/crashtests/371124-1.html
new file mode 100644
index 000000000..ccefd3a32
--- /dev/null
+++ b/dom/base/crashtests/371124-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="371124-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/371124-2-inner.html b/dom/base/crashtests/371124-2-inner.html
new file mode 100644
index 000000000..788309382
--- /dev/null
+++ b/dom/base/crashtests/371124-2-inner.html
@@ -0,0 +1,10 @@
+<html>
+<body>
+
+<script>
+ document.all.tags.__proto__ = null;
+ alert(document.all.tags)
+</script>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/371124-2.html b/dom/base/crashtests/371124-2.html
new file mode 100644
index 000000000..93897635f
--- /dev/null
+++ b/dom/base/crashtests/371124-2.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="371124-2-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/371466-1.xhtml b/dom/base/crashtests/371466-1.xhtml
new file mode 100644
index 000000000..8da0b22b1
--- /dev/null
+++ b/dom/base/crashtests/371466-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var marquee = document.getElementById("marquee");
+ var span = document.getElementById("span");
+ marquee.appendChild(span);
+ marquee.removeChild(span);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<marquee id="marquee" />
+
+<span id="span"><div>Foo</div><textarea/></span>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/372554-1.html b/dom/base/crashtests/372554-1.html
new file mode 100644
index 000000000..a87edcecb
--- /dev/null
+++ b/dom/base/crashtests/372554-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ if (location.protocol == "file:") {
+ try {
+ location.hostname = 'foo';
+ } catch(e) {
+ }
+ }
+
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 30)">
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/375399-1-inner.xhtml b/dom/base/crashtests/375399-1-inner.xhtml
new file mode 100644
index 000000000..46573b49c
--- /dev/null
+++ b/dom/base/crashtests/375399-1-inner.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:svg="http://www.w3.org/2000/svg">
+<svg:foreignObject x="0" y="0" width="100%" height="100%">
+<xul:tabs onselect="window.frameElement.parentNode.removeChild(window.frameElement)"><xul:tree id="t"/></xul:tabs>
+</svg:foreignObject>
+
+<html:script>
+function doe() {
+document.getElementById('t');
+}
+setTimeout(doe, 200);
+</html:script>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/375399-1.html b/dom/base/crashtests/375399-1.html
new file mode 100644
index 000000000..8e50c7ef3
--- /dev/null
+++ b/dom/base/crashtests/375399-1.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+<head>
+<title>Testcase bug 375399 - Crash [@ nsElementSH::PostCreate] when removing window when accessing xul:tree in xul:tabs onselect in svg:foreignObject</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head>
+<body>
+<iframe id="content" src="./375399-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/377360-1.xhtml b/dom/base/crashtests/377360-1.xhtml
new file mode 100644
index 000000000..77fa300be
--- /dev/null
+++ b/dom/base/crashtests/377360-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ var div = document.getElementById("div");
+ div.textContent = String.fromCharCode(0xDCBF);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="div"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/377960-1.html b/dom/base/crashtests/377960-1.html
new file mode 100644
index 000000000..c61002eee
--- /dev/null
+++ b/dom/base/crashtests/377960-1.html
@@ -0,0 +1,12 @@
+<html><head>
+
+</head>
+<body onblur="document.activeElement.style.display = 'none'" tabindex="4" onfocus="var x=document.getElementsByTagName('*');var i = Math.floor(Math.random()*x.length);x[i].focus()" style="overflow: scroll;">
+
+
+
+<iframe tabindex="2" style="overflow: scroll; display: inline; position: fixed; direction: rtl;"></iframe>
+
+<select onblur="event.target.setAttribute('tabindex', Math.floor(Math.random()*5)-9)" style="overflow: scroll; display: table; position: absolute; float: right; direction: rtl;"></select>
+
+</body></html> \ No newline at end of file
diff --git a/dom/base/crashtests/377960-2.html b/dom/base/crashtests/377960-2.html
new file mode 100644
index 000000000..dc42dc00d
--- /dev/null
+++ b/dom/base/crashtests/377960-2.html
@@ -0,0 +1,7 @@
+<html>
+<head><title>Click the &lt;select&gt; to crash.</title></head>
+<body onfocus="document.documentElement.focus(); document.body.style.display = 'none';">
+<iframe style="position: fixed;"></iframe>
+<select style="position: absolute;"></select>
+</body>
+</html>
diff --git a/dom/base/crashtests/384663-1-inner.xul b/dom/base/crashtests/384663-1-inner.xul
new file mode 100644
index 000000000..f2914ce0a
--- /dev/null
+++ b/dom/base/crashtests/384663-1-inner.xul
@@ -0,0 +1,18 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tree>
+ <splitter style="overflow: scroll;">
+ <treecols style="overflow: scroll; display: block;">
+ <treeitem id="mw_b" style=" display: list-item;"/>
+ </treecols>
+ </splitter>
+</tree>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe() {
+window.addEventListener('DOMAttrModified', function(e) {document.removeChild(document.documentElement); }, true);
+ var y=document.getElementById('mw_b');
+ y.parentNode.removeChild(y);
+}
+setTimeout(doe, 200);
+</script>
+</window> \ No newline at end of file
diff --git a/dom/base/crashtests/384663-1.html b/dom/base/crashtests/384663-1.html
new file mode 100644
index 000000000..8cef4f588
--- /dev/null
+++ b/dom/base/crashtests/384663-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="384663-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/386000-1.html b/dom/base/crashtests/386000-1.html
new file mode 100644
index 000000000..0169a28fb
--- /dev/null
+++ b/dom/base/crashtests/386000-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script>
+
+var de;
+
+function boom()
+{
+ de = document.documentElement;
+ document.addEventListener("DOMNodeRemoved", f, false);
+
+ function f()
+ {
+ document.removeEventListener("DOMNodeRemoved", f, false);
+ de.appendChild(document.createElement("body"));
+ }
+
+ document.removeChild(de);
+
+ setTimeout(cont, 30);
+}
+
+function cont()
+{
+ document.appendChild(de);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+<body onload="setTimeout(boom, 30);">
+
+</body>
+</html>
diff --git a/dom/base/crashtests/386794-1.html b/dom/base/crashtests/386794-1.html
new file mode 100644
index 000000000..4b5022168
--- /dev/null
+++ b/dom/base/crashtests/386794-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var weirdScript = document.createElementNS('http://example.com/foo', 'script');
+ document.body.appendChild(weirdScript);
+ document.body.innerHTML;
+}
+
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
diff --git a/dom/base/crashtests/387460-1-inner.xhtml b/dom/base/crashtests/387460-1-inner.xhtml
new file mode 100644
index 000000000..33b1891e7
--- /dev/null
+++ b/dom/base/crashtests/387460-1-inner.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<a id="a" href="#"></a>
+
+<table><tbody>
+<tr><td id="d"/></tr>
+<tr id="b"><td id="c"></td></tr>
+</tbody></table>
+
+
+<script>
+function doe() {
+ document.getElementById('b').appendChild(document.getElementById('c'));
+ window.addEventListener('DOMAttrModified', function(e){document.getElementById('a').focus();}, true);
+ document.getElementById('d').setAttribute('rowspan', 3);
+}
+setTimeout(doe, 200);
+</script>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/387460-1.html b/dom/base/crashtests/387460-1.html
new file mode 100644
index 000000000..bd1fc9353
--- /dev/null
+++ b/dom/base/crashtests/387460-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="387460-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/395469-1.xhtml b/dom/base/crashtests/395469-1.xhtml
new file mode 100644
index 000000000..937ace8d3
--- /dev/null
+++ b/dom/base/crashtests/395469-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="empty"><content></content></binding></bindings>
+
+<style>
+
+.bef:before { content: counter(c); }
+
+.fl:first-letter { }
+
+</style>
+
+<script>
+
+function boom()
+{
+ document.getElementById("xblize").style.MozBinding = "url('#empty')";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div class="fl"><span class="bef" id="xblize"></span><span class="bef"></span></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/395469-2.xhtml b/dom/base/crashtests/395469-2.xhtml
new file mode 100644
index 000000000..7da320256
--- /dev/null
+++ b/dom/base/crashtests/395469-2.xhtml
@@ -0,0 +1,45 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="empty"><content></content></binding></bindings>
+
+<style>
+
+.bef:before { content: counter(c); }
+
+.fl:first-letter { }
+
+</style>
+
+<script>
+
+var xblize, div;
+
+function boom()
+{
+ xblize = document.getElementById("xblize");
+ div = document.getElementById("div");
+
+ xblize.style.MozBinding = "url('#empty')";
+
+ // Give the XBL extra time to settle
+ setTimeout(boom2, 200);
+}
+
+function boom2()
+{
+ div.removeChild(xblize);
+ div.appendChild(xblize);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div class="fl" id="div"><span class="bef" id="xblize"></span><span class="bef"></span></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/398088-1.xul b/dom/base/crashtests/398088-1.xul
new file mode 100644
index 000000000..6548a11be
--- /dev/null
+++ b/dom/base/crashtests/398088-1.xul
@@ -0,0 +1,23 @@
+<window onload="boom();" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>
+
+function boom()
+{
+ var p = document.getElementById("p");
+
+ document.addEventListener("DOMAttrModified", removeP, true);
+
+ p.removeAttribute("mode");
+
+ function removeP()
+ {
+ document.documentElement.removeChild(p);
+ }
+}
+
+</script>
+
+<progressmeter id="p" mode="determined" />
+
+</window>
diff --git a/dom/base/crashtests/399712-1.html b/dom/base/crashtests/399712-1.html
new file mode 100644
index 000000000..58e957309
--- /dev/null
+++ b/dom/base/crashtests/399712-1.html
@@ -0,0 +1,29 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("ta").style.overflow = "scroll";
+ setTimeout(boom2, 12);
+}
+
+function boom2()
+{
+ document.getElementById("ta").style.overflow = "";
+ setTimeout(boom, 12);
+}
+
+function cont()
+{
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="boom(); setTimeout(cont, 800);">
+
+<textarea id="ta">x</textarea>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/400763-1.html b/dom/base/crashtests/400763-1.html
new file mode 100644
index 000000000..2de672090
--- /dev/null
+++ b/dom/base/crashtests/400763-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+<script src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12NgYPgPAAEDAQDZqt2zAAAAAElFTkSuQmCC" charset="UTF-8"></script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/401993-1.html b/dom/base/crashtests/401993-1.html
new file mode 100644
index 000000000..b8679dfd0
--- /dev/null
+++ b/dom/base/crashtests/401993-1.html
@@ -0,0 +1,38 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function s()
+{
+ var x = document.getElementById("x");
+ x.style.MozBinding = "url(401993-1.xml#foo)";
+
+ setTimeout(boom, 0);
+
+ function boom()
+ {
+ var nodes = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(x));
+ if (!nodes) {
+ setTimeout(boom, 10);
+ return;
+ }
+
+ var newSpan = document.createElement("span");
+ newSpan.contentEditable = "true";
+ nodes[0].appendChild(newSpan);
+ x.parentNode.removeChild(x);
+
+ document.documentElement.removeAttribute("class");
+ }
+}
+</script>
+</head>
+
+<body onload="s();">
+
+<span contenteditable="true"></span>
+
+<div id="x"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/401993-1.xml b/dom/base/crashtests/401993-1.xml
new file mode 100644
index 000000000..747f8a5f8
--- /dev/null
+++ b/dom/base/crashtests/401993-1.xml
@@ -0,0 +1 @@
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><span xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></span></content></binding></bindings> \ No newline at end of file
diff --git a/dom/base/crashtests/404869-1.xul b/dom/base/crashtests/404869-1.xul
new file mode 100644
index 000000000..f5c7facff
--- /dev/null
+++ b/dom/base/crashtests/404869-1.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="empty"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var menupopup = document.getElementById("menupopup");
+ var x = SpecialPowers.wrap(document).getAnonymousNodes(menupopup)[0];
+ menupopup.style.MozBinding = "url('#empty')";
+ for (var ppp in x) {
+ }
+}
+
+</script>
+
+<menupopup id="menupopup"/>
+
+</window>
diff --git a/dom/base/crashtests/407818.html b/dom/base/crashtests/407818.html
new file mode 100644
index 000000000..eea475be4
--- /dev/null
+++ b/dom/base/crashtests/407818.html
@@ -0,0 +1,5 @@
+<html>
+<head>
+</head>
+<body contenteditable="true" onload="document.execCommand('selectAll', false, null);"><ol> <li></li></ol></body>
+</html>
diff --git a/dom/base/crashtests/410860-1.xml b/dom/base/crashtests/410860-1.xml
new file mode 100644
index 000000000..4a7414fc9
--- /dev/null
+++ b/dom/base/crashtests/410860-1.xml
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ onload="document.getElementById('x').getBoundingClientRect();">
+
+<rect id="x"/>
+
+</svg>
+
diff --git a/dom/base/crashtests/411882-1.xhtml b/dom/base/crashtests/411882-1.xhtml
new file mode 100644
index 000000000..6cd121044
--- /dev/null
+++ b/dom/base/crashtests/411882-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body></body><textarea></textarea></html> \ No newline at end of file
diff --git a/dom/base/crashtests/416734-1.html b/dom/base/crashtests/416734-1.html
new file mode 100644
index 000000000..fc5ed546a
--- /dev/null
+++ b/dom/base/crashtests/416734-1.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+</head>
+
+<body style="direction: rtl; visibility: collapse; white-space: pre;"><span style="display: -moz-inline-stack;"><span><span style="font-size: 0pt; border: 1px dotted red; white-space: -moz-pre-wrap;">
+
+X X }
+
+
+ </span>
+ </span></span></body>
+
+</html>
diff --git a/dom/base/crashtests/417852-1.html b/dom/base/crashtests/417852-1.html
new file mode 100644
index 000000000..bf8ba3486
--- /dev/null
+++ b/dom/base/crashtests/417852-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+window.__proto__ = null;
+Object.prototype.__proto__ = window;
+
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/418928-1.html b/dom/base/crashtests/418928-1.html
new file mode 100644
index 000000000..a3e42fe6f
--- /dev/null
+++ b/dom/base/crashtests/418928-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.execCommand('selectAll', false, null);">
+
+<select><option contenteditable="true">A</option></select>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/420620-1.html b/dom/base/crashtests/420620-1.html
new file mode 100644
index 000000000..5fc2ea3bc
--- /dev/null
+++ b/dom/base/crashtests/420620-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var a = document.documentElement;
+ var b = document.body;
+
+ document.removeChild(a);
+ b.contentEditable = "true";
+ document.appendChild(a);
+
+ function t() {
+ document.removeEventListener("DOMAttrModified", t, false);
+ document.removeChild(a);
+ }
+
+ document.addEventListener("DOMAttrModified", t, false);
+ document.execCommand("insertunorderedlist", false, "<h1>");
+ document.removeEventListener("DOMAttrModified", t, false);
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/dom/base/crashtests/424276-1.html b/dom/base/crashtests/424276-1.html
new file mode 100644
index 000000000..feb39bf33
--- /dev/null
+++ b/dom/base/crashtests/424276-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ window.getSelection().selectAllChildren(document.createTextNode("\n\n"));
+ window.getSelection().addRange(document.createRange());
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/dom/base/crashtests/426987-1.html b/dom/base/crashtests/426987-1.html
new file mode 100644
index 000000000..7d277156e
--- /dev/null
+++ b/dom/base/crashtests/426987-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<iframe src="data:text/html,<html><body onunload=&quot;parent.document.body.style.overflow = 'auto';&quot;></body></html>"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/43040-1.html b/dom/base/crashtests/43040-1.html
new file mode 100644
index 000000000..00165763c
--- /dev/null
+++ b/dom/base/crashtests/43040-1.html
@@ -0,0 +1,19 @@
+<HTML>
+<HEAD>
+<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
+<script>
+var xmlDoc;
+
+function createDoc()
+{
+ var xmlDoc = document.implementation.createDocument("", "", null);
+ var xmlElem = xmlDoc.firstChild;
+ xmlElem.appendChild(document.createTextNode("blabla"));
+ xmlElem.firstChild.nodeValue;
+}
+</script>
+
+</HEAD>
+<BODY onload="createDoc();">
+</BODY>
+</HTML>
diff --git a/dom/base/crashtests/439206-1.html b/dom/base/crashtests/439206-1.html
new file mode 100644
index 000000000..688ebe44d
--- /dev/null
+++ b/dom/base/crashtests/439206-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.createElement("STYLE");
+ var t = document.createTextNode("\uDB00x"); // a high surrogate followed by 'x'
+ document.documentElement.appendChild(s);
+ s.appendChild(t);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/base/crashtests/443538-1.svg b/dom/base/crashtests/443538-1.svg
new file mode 100644
index 000000000..cb7388a7c
--- /dev/null
+++ b/dom/base/crashtests/443538-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ onload="document.getElementById('use').removeChild(document.getElementById('s'));">
+
+ <use id="use" xlink:href="#s"><g id="s"/></use>
+
+</svg>
diff --git a/dom/base/crashtests/448615-1.html b/dom/base/crashtests/448615-1.html
new file mode 100644
index 000000000..bfb4f365a
--- /dev/null
+++ b/dom/base/crashtests/448615-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { float: right; }
+
+</style>
+</head>
+
+<body><div>A</div></body>
+
+</html>
diff --git a/dom/base/crashtests/450383-1.html b/dom/base/crashtests/450383-1.html
new file mode 100644
index 000000000..3c95b966c
--- /dev/null
+++ b/dom/base/crashtests/450383-1.html
@@ -0,0 +1,9 @@
+<html>
+<BODY></BODY>
+<SCRIPT>
+ document.addEventListener("DOMCharacterDataModified",function(){
+ document.body.innerHTML=""; // change this to see memory corruption
+ },true);
+ document.body.innerHTML="<optGroup</form<textArea";
+</SCRIPT>
+</html>
diff --git a/dom/base/crashtests/450385-1.html b/dom/base/crashtests/450385-1.html
new file mode 100644
index 000000000..e75159c51
--- /dev/null
+++ b/dom/base/crashtests/450385-1.html
@@ -0,0 +1,11 @@
+<html>
+<BODY></BODY>
+<SCRIPT>
+document.body.addEventListener("DOMCharacterDataModified", function () {
+ document.body.innerHTML = "";
+ eventChild.appendChild(event.relatedNode);
+}, true);
+document.addEventListener("DOMNodeInserted", function () {}, true);
+document.body.innerHTML="]<kbd><small></kbd><base><optGroup></optGroup>";
+</SCRIPT>
+</html>
diff --git a/dom/base/crashtests/458637-1-inner.xhtml b/dom/base/crashtests/458637-1-inner.xhtml
new file mode 100644
index 000000000..f91d6e5b4
--- /dev/null
+++ b/dom/base/crashtests/458637-1-inner.xhtml
@@ -0,0 +1,4 @@
+<?xml-stylesheet type="text/xsl" href="#a"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/458637-1.html b/dom/base/crashtests/458637-1.html
new file mode 100644
index 000000000..124846fcb
--- /dev/null
+++ b/dom/base/crashtests/458637-1.html
@@ -0,0 +1,29 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var iterations = 0;
+var start = new Date();
+
+function boom()
+{
+ document.getElementById("i").style.overflow = "scroll";
+ document.getElementById("i").src = document.getElementById("i").src;
+ setTimeout(boom2, 10); // must be a short timeout
+}
+
+function boom2()
+{
+ document.getElementById("i").style.overflow = "";
+ var now = new Date();
+ if (++iterations < 20 && now - start < 5000)
+ setTimeout(boom, 10);
+ else
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="i" src="458637-1-inner.xhtml" style="visibility: collapse;"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/462947.html b/dom/base/crashtests/462947.html
new file mode 100644
index 000000000..09581b308
--- /dev/null
+++ b/dom/base/crashtests/462947.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+navigator.mimeTypes.length;
+navigator.mimeTypes.length;
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/467392.html b/dom/base/crashtests/467392.html
new file mode 100644
index 000000000..a64044c6e
--- /dev/null
+++ b/dom/base/crashtests/467392.html
@@ -0,0 +1,4 @@
+<script>
+document.write(document.body.innerHTML);
+window.location.reload();
+</script>
diff --git a/dom/base/crashtests/472593-1.html b/dom/base/crashtests/472593-1.html
new file mode 100644
index 000000000..ad8fe34bf
--- /dev/null
+++ b/dom/base/crashtests/472593-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<body onload="document.getElementById('t').value = '';">
+<textarea rows="10" cols="1" wrap="hard" id="t">&#9;&#9;</textarea>
+</body>
+</html>
diff --git a/dom/base/crashtests/473284.xul b/dom/base/crashtests/473284.xul
new file mode 100644
index 000000000..2a00d2783
--- /dev/null
+++ b/dom/base/crashtests/473284.xul
@@ -0,0 +1,93 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ class="reftest-wait"
+onload="
+var result = '';
+try {
+ document.commandDispatcher.advanceFocusIntoSubtree({});
+ result += '1';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.advanceFocusIntoSubtree(document.documentElement);
+ result += '2';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.advanceFocusIntoSubtree(null);
+ result += '3';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedElement = {};
+ result += '4';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedElement = document.documentElement;
+ result += '5';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedElement = null;
+ result += '6';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.popupNode = {};
+ result += '7';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.popupNode = document.documentElement;
+ result += '8';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.popupNode = null;
+ result += '9';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedWindow = {};
+ result += 'a';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedWindow = null;
+ result += 'b';
+} catch (ex) {
+ result += '.';
+}
+
+try {
+ document.commandDispatcher.focusedWindow = window;
+ result += 'c';
+} catch (ex) {
+ result += '.';
+}
+
+document.documentElement.textContent = result == '.23.56.89.bc' ? 'PASSED' : 'FAILED';
+if (document.documentElement.textContent == 'PASSED') {
+ document.documentElement.removeAttribute('class');
+}
+"/>
diff --git a/dom/base/crashtests/474041-1.svg b/dom/base/crashtests/474041-1.svg
new file mode 100644
index 000000000..2b8351472
--- /dev/null
+++ b/dom/base/crashtests/474041-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="boom();">
+
+<rect id="r"/><use id="u" xlink:href="#r"><rect id="r"/></use>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var r1 = document.getElementsByTagName("rect")[0]; // the first node with id="r"
+ var use = document.getElementById("u");
+ document.documentElement.insertBefore(use, r1);
+ r1.appendChild(use);
+}
+
+</script>
+
+</svg>
diff --git a/dom/base/crashtests/476526.html b/dom/base/crashtests/476526.html
new file mode 100644
index 000000000..b3d8f8e1c
--- /dev/null
+++ b/dom/base/crashtests/476526.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<iframe src="data:text/xml,
+ <html xmlns='http://www.w3.org/1999/xhtml'
+ onDOMAttrModified='window.frameElement.parentNode.removeChild(window.frameElement)'>
+ </html>"
+ onload="event.target.contentDocument.documentElement.setAttribute('x', 'y');"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/483818-1.html b/dom/base/crashtests/483818-1.html
new file mode 100644
index 000000000..11cc7c4ac
--- /dev/null
+++ b/dom/base/crashtests/483818-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+function appendScript(doc) {
+ var s = doc.createElement("script");
+ s.textContent = "document.write('executed'); document.close()";
+ doc.body.appendChild(s);
+}
+ </script>
+ </head>
+ <body onload="appendScript(window.document)">
+ </body>
+</html>
diff --git a/dom/base/crashtests/490760-1.xhtml b/dom/base/crashtests/490760-1.xhtml
new file mode 100644
index 000000000..bfa6732e8
--- /dev/null
+++ b/dom/base/crashtests/490760-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var q = document.getElementsByTagName("style")[0];
+
+ window.addEventListener("DOMNodeRemoved", f, false);
+ q.innerHTML = "<span><\/span>";
+ window.removeEventListener("DOMNodeRemoved", f, false);
+
+ function f()
+ {
+ window.removeEventListener("DOMNodeRemoved", f, false);
+ q.removeChild(q.childNodes[1]);
+ }
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();"><style><span></span><span></span></style></body>
+</html>
diff --git a/dom/base/crashtests/493281-1.html b/dom/base/crashtests/493281-1.html
new file mode 100644
index 000000000..6dd3dd4a1
--- /dev/null
+++ b/dom/base/crashtests/493281-1.html
@@ -0,0 +1,7 @@
+<html>
+ <body>
+ <div id="foo">
+ <script>with (document.all) foo</script>
+ </div>
+ </body>
+</html>
diff --git a/dom/base/crashtests/493281-2.html b/dom/base/crashtests/493281-2.html
new file mode 100644
index 000000000..236962469
--- /dev/null
+++ b/dom/base/crashtests/493281-2.html
@@ -0,0 +1,12 @@
+<html>
+ <body>
+ <div id="foo">
+ <script>
+ function get(x) { return x }
+ obj = {};
+ obj.__proto__ = get(document.all);
+ obj.foo
+ </script>
+ </div>
+ </body>
+</html>
diff --git a/dom/base/crashtests/494810-1.html b/dom/base/crashtests/494810-1.html
new file mode 100644
index 000000000..e0036cd83
--- /dev/null
+++ b/dom/base/crashtests/494810-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.domain = "[";
+ window.sessionStorage;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/499006-1.html b/dom/base/crashtests/499006-1.html
new file mode 100644
index 000000000..f02720b84
--- /dev/null
+++ b/dom/base/crashtests/499006-1.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function select(start, startOffset, end, endOffset) {
+ var sel = getSelection();
+ sel.removeAllRanges();
+ var range = document.createRange();
+ range.setStart(start, startOffset);
+ range.setEnd(end, endOffset);
+ sel.addRange(range);
+}
+
+function boom() {
+ var p = document.body;
+ select(p.childNodes[0],0,p.childNodes[0],1);
+ sel = getSelection();
+ range = sel.getRangeAt(0);
+ range.detach();
+ range.insertNode(p);
+}
+
+</script>
+</head>
+<body onload="boom()"><span>Hello Kitty</span></body>
+</html>
diff --git a/dom/base/crashtests/499006-2.html b/dom/base/crashtests/499006-2.html
new file mode 100644
index 000000000..86907c5bb
--- /dev/null
+++ b/dom/base/crashtests/499006-2.html
@@ -0,0 +1,35 @@
+<html>
+<head>
+<script>
+function extractc(j) {
+var sel = window.getSelection();
+
+
+var b=document.getElementById('b');
+
+var range =document.createRange();
+range.setStart(document.documentElement, 0);
+range.setEnd(document.documentElement, 0);
+sel.addRange(range);
+range.extractContents();
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+}
+setTimeout(extractc,200,0);
+</script>
+<title id="b"></title>
+</head>
+<body>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/502617.html b/dom/base/crashtests/502617.html
new file mode 100644
index 000000000..4d4487817
--- /dev/null
+++ b/dom/base/crashtests/502617.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+var a = {};
+a instanceof HTMLImageElement;
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/504224.html b/dom/base/crashtests/504224.html
new file mode 100644
index 000000000..71e561d74
--- /dev/null
+++ b/dom/base/crashtests/504224.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<title>Crash [@ nsFocusManager::GetCommonAncestor], part 2</title>
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%0A%3Cbody%20onunload%3D%22window.frameElement.parentNode.removeChild%28window.frameElement%29%22%20tabindex%3D%221%22%3E%0A%3Cscript%3E%0Adocument.body.focus%28%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E" id="content"></iframe>
+<script>
+var src=document.getElementById('src');
+setInterval(function() {
+ if (!document.getElementById('content')) {
+ var x=document.createElement('iframe');
+ x.src=src;
+ x.id = 'content';
+ document.body.appendChild(x);
+ setTimeout(function() { window.focus(); document.documentElement.removeAttribute('class'); }, 100);
+ } else
+ window.frames[0].location.reload();
+}, 500);
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/509536-1.html b/dom/base/crashtests/509536-1.html
new file mode 100644
index 000000000..988164601
--- /dev/null
+++ b/dom/base/crashtests/509536-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var frame = document.createElement("iframe");
+ frame.setAttribute("src", "1");
+ document.body.appendChild(frame);
+ frame.setAttribute("src", "2");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/522516-1.html b/dom/base/crashtests/522516-1.html
new file mode 100644
index 000000000..87891ea19
--- /dev/null
+++ b/dom/base/crashtests/522516-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('a').appendChild(document.getElementById('b'));">
+
+<div id="b"></div>
+<div style="filter: url(#b);"></div>
+<div id="a"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/529670.html b/dom/base/crashtests/529670.html
new file mode 100644
index 000000000..52e66ab8c
--- /dev/null
+++ b/dom/base/crashtests/529670.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 529670</title>
+<script>
+function boom() {
+ document.createRange().getClientRects()
+ document.createRange().getBoundingClientRect()
+
+ var range = document.createRange();
+ range.detach();
+ range.getClientRects()
+ range.getBoundingClientRect()
+}
+</script>
+</head>
+<body onload="boom()"></body>
+</html>
diff --git a/dom/base/crashtests/535926-1.html b/dom/base/crashtests/535926-1.html
new file mode 100644
index 000000000..bddd8dc28
--- /dev/null
+++ b/dom/base/crashtests/535926-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+
+<script type="text/javascript">
+
+var i = 0;
+function mmf()
+{
+ if (++i == 2) {
+ document.body.innerHTML = "<marquee>";
+ document.documentElement.removeAttribute("class");
+ }
+}
+
+function init()
+{
+ document.documentElement.offsetHeight;
+ for (var j = 0; j < 2; ++j) {
+ var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ iframe.addEventListener("load", mmf, false);
+ document.body.appendChild(iframe);
+ }
+}
+
+</script>
+</head>
+<body onload="setTimeout(init, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/543645.html b/dom/base/crashtests/543645.html
new file mode 100644
index 000000000..622666957
--- /dev/null
+++ b/dom/base/crashtests/543645.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<body> <span></span> <script>
+function boom() {
+ var range = document.createRange();
+ range.setEnd(document.body.childNodes[2], 0);
+ window.addEventListener("DOMNodeInserted", f, true);
+ function f() {
+ window.removeEventListener("DOMNodeInserted", f, true);
+ range.deleteContents();
+ }
+ range.deleteContents();
+}
+window.addEventListener("load", boom, false);
+</script>
diff --git a/dom/base/crashtests/551631-1.html b/dom/base/crashtests/551631-1.html
new file mode 100644
index 000000000..90a84ce58
--- /dev/null
+++ b/dom/base/crashtests/551631-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<base href="javascript:5">
+<script>
+
+function boom()
+{
+ var head = document.getElementsByTagName("head")[0];
+ var s = document.createElement("script");
+ s.async = "async";
+ s.src = "useBaseHrefAndFail";
+ s.q = "q";
+ head.appendChild(s);
+ head.removeChild(s);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/552651.html b/dom/base/crashtests/552651.html
new file mode 100644
index 000000000..8c2a9b09f
--- /dev/null
+++ b/dom/base/crashtests/552651.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+ <title>Testcase for bug 552651</title>
+ <script class="testbody" type="text/javascript">
+
+function testCancel() {
+ var xhr = new XMLHttpRequest();
+ xhr.addEventListener("readystatechange", function(e) {
+ if (xhr.readyState == 3) // NOTE : only leaks for state == 3
+ xhr.abort();
+ else if (xhr.readyState == 4)
+ document.documentElement.className = "";
+ }, false);
+
+ xhr.open("GET", "552651.xml", true);
+ xhr.send();
+}
+</script>
+</head>
+<body onload="testCancel()">
+This test should not leak...
+</body>
+</html>
+
diff --git a/dom/base/crashtests/552651.xml b/dom/base/crashtests/552651.xml
new file mode 100644
index 000000000..b04b966cf
--- /dev/null
+++ b/dom/base/crashtests/552651.xml
@@ -0,0 +1,2 @@
+<foo>test</foo>
+
diff --git a/dom/base/crashtests/554230-1.xhtml b/dom/base/crashtests/554230-1.xhtml
new file mode 100644
index 000000000..753d5c0fd
--- /dev/null
+++ b/dom/base/crashtests/554230-1.xhtml
@@ -0,0 +1,15 @@
+<html class="reftest-wait" xmlns="http://www.w3.org/1999/xhtml"><iframe contenteditable="true"></iframe><span></span><script style="display: none;" id="fuzz1" type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ document.getElementsByTagName("iframe")[0].focus();
+ document.getElementsByTagName("span")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div"));
+ document.execCommand("selectAll", false, null);
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></html>
diff --git a/dom/base/crashtests/558973.html b/dom/base/crashtests/558973.html
new file mode 100644
index 000000000..878b8c925
--- /dev/null
+++ b/dom/base/crashtests/558973.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var child = document.createTextNode("a");
+
+var attr = document.createAttribute("a");
+try {
+ attr.appendChild(child);
+}
+catch (e) {
+}
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/561981-1-iframe.xhtml b/dom/base/crashtests/561981-1-iframe.xhtml
new file mode 100644
index 000000000..bca0cf73f
--- /dev/null
+++ b/dom/base/crashtests/561981-1-iframe.xhtml
@@ -0,0 +1,56 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+var i = 0;
+
+function init()
+{
+ targetWindow = window.frames[0];
+ targetDocument = targetWindow.document;
+ targetDocument.body.appendChild(targetDocument.importNode(document.getElementById('rootish'), true));
+ targetDocument.designMode = 'on';
+ setTimeout(boom, 30);
+}
+
+function boom()
+{
+ var r = targetDocument.createRange();
+ r.setStart(targetDocument.getElementById("bar"), 0);
+ r.setEnd(targetDocument.getElementById("baz").firstChild, 0);
+ targetWindow.getSelection().addRange(r);
+ targetDocument.execCommand("indent", false, null);
+ setTimeout(whack, 300);
+}
+
+function whack()
+{
+ if (++i > 100) return;
+ document.documentElement.style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns=\"http://www.mozilla.org/xbl\"><binding id=\"foo\" g=\""+Math.random()+"\"><content>\n<\/content><\/binding><\/bindings>\n") + '")';
+ setTimeout(bonk, 10);
+}
+
+function bonk()
+{
+ document.getElementById("i").style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns=\"http://www.mozilla.org/xbl\"><binding id=\"foo\" g=\""+Math.random()+"\"><content>\n\n<\/content><\/binding><\/bindings>\n") + '")';
+ document.documentElement.style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns=\"http://www.mozilla.org/xbl\"><binding id=\"foo\" g=\""+Math.random()+"\"><content><iframe xmlns=\"http://www.w3.org/1999/xhtml\" src=\"data:text/html,\" style=\"width: 95%; height: 500px;\"><\/iframe><\/content><\/binding><\/bindings>\n") + '")';
+ setTimeout(whack, 10);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="init()">
+
+<iframe id="i" src="data:text/html," style="width: 95%; height: 500px;"/>
+
+<div id="rootish">
+ <div>Foo</div>
+ <div id="bar">Bar</div>
+ <div><select><option id="baz">baz</option></select></div>
+</div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/561981-1.html b/dom/base/crashtests/561981-1.html
new file mode 100644
index 000000000..270f832c7
--- /dev/null
+++ b/dom/base/crashtests/561981-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<head>
+<script>
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(finish, 5000)">
+<iframe src="561981-1-iframe.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/561981-2-iframe.xhtml b/dom/base/crashtests/561981-2-iframe.xhtml
new file mode 100644
index 000000000..7164c0a6a
--- /dev/null
+++ b/dom/base/crashtests/561981-2-iframe.xhtml
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+var i = 0;
+
+function init()
+{
+ targetWindow = window.frames[0];
+ targetDocument = targetWindow.document;
+ targetDocument.designMode = 'on';
+ setTimeout(whack, 30);
+}
+
+function whack()
+{
+ if (++i > 100) return;
+ document.documentElement.style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns=\"http://www.mozilla.org/xbl\"><binding id=\"foo\" g=\""+Math.random()+"\"><content>\n<\/content><\/binding><\/bindings>\n") + '")';
+ setTimeout(bonk, 10);
+}
+
+function bonk()
+{
+ document.getElementById("i").style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns=\"http://www.mozilla.org/xbl\"><binding id=\"foo\" g=\""+Math.random()+"\"><content>\n\n<\/content><\/binding><\/bindings>\n") + '")';
+ setTimeout(whack, 10);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="init()">
+
+<iframe id="i" src="data:text/html," style="width: 95%; height: 500px;"/>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/561981-2.html b/dom/base/crashtests/561981-2.html
new file mode 100644
index 000000000..bac13eeea
--- /dev/null
+++ b/dom/base/crashtests/561981-2.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<head>
+<script>
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(finish, 5000)">
+<iframe src="561981-2-iframe.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/564079-1.html b/dom/base/crashtests/564079-1.html
new file mode 100644
index 000000000..1c97ff967
--- /dev/null
+++ b/dom/base/crashtests/564079-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+document.createTextNode("x").lookupPrefix("");
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/564114.html b/dom/base/crashtests/564114.html
new file mode 100644
index 000000000..93786e222
--- /dev/null
+++ b/dom/base/crashtests/564114.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<script type="text/javascript">
+
+document.documentElement.compareDocumentPosition(null);
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/565125-1.html b/dom/base/crashtests/565125-1.html
new file mode 100644
index 000000000..ceeb923f4
--- /dev/null
+++ b/dom/base/crashtests/565125-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createTextNode(" ");
+ (document.documentElement).appendChild(a);
+ var b = document.createElement("span");
+ (document.documentElement).appendChild(b);
+ var c = document.createTextNode(" ");
+ (document.documentElement).appendChild(c);
+ var r = document.createRange();
+ r.setStart(a, 0);
+ r.setEnd(c, 0);
+ try {
+ r.surroundContents(document.documentElement);
+ } catch(e) {
+ }
+ document.documentElement.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/575462.svg b/dom/base/crashtests/575462.svg
new file mode 100644
index 000000000..8131d5f1f
--- /dev/null
+++ b/dom/base/crashtests/575462.svg
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<g id="a"><g id="b"/></g>
+
+<script type="text/javascript">
+<![CDATA[
+
+function j()
+{
+ var a = document.getElementById("a");
+ var b = document.getElementById("b");
+ window.addEventListener("DOMAttrModified", k, true);
+ function k()
+ {
+ window.removeEventListener("DOMAttrModified", k, true);
+ a.appendChild(b);
+ }
+ b.removeAttribute("id");
+}
+
+window.addEventListener("load", j, false);
+
+]]>
+</script>
+</svg>
diff --git a/dom/base/crashtests/582601.html b/dom/base/crashtests/582601.html
new file mode 100644
index 000000000..4fb854a42
--- /dev/null
+++ b/dom/base/crashtests/582601.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+ <title>Crashtest</title>
+<script>
+var attr = document.createAttribute("foo");
+attr.lookupPrefix("");
+</script>
+</head>
+<body>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/590395-1.html b/dom/base/crashtests/590395-1.html
new file mode 100644
index 000000000..3b653c5e7
--- /dev/null
+++ b/dom/base/crashtests/590395-1.html
@@ -0,0 +1,5 @@
+<html>
+<body onload="document.createElement('div').appendChild(document.getElementById('i').contentDocument.getElementById('j'));">
+<iframe id="i" src="data:text/html,<img id='j' src='about:blank'>">
+</body>
+</html>
diff --git a/dom/base/crashtests/593302-1.html b/dom/base/crashtests/593302-1.html
new file mode 100644
index 000000000..d433de0d5
--- /dev/null
+++ b/dom/base/crashtests/593302-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <head>
+ <script type="text/javascript">
+ function boom()
+ {
+ iframe = document.getElementById("iframe");
+ iframeBody = iframe.contentDocument.body;
+ iframeBody.appendChild(makeNamedSpan("w"));
+ remove(iframe);
+ iframeBody.appendChild(makeNamedSpan("w"));
+ remove(iframeBody);
+ document.documentElement.className = "";
+ }
+
+ function makeNamedSpan(i)
+ {
+ var s = document.createElement("span");
+ s.id = i;
+ return s;
+ }
+
+ function remove(n) { n.parentNode.removeChild(n); }
+ </script>
+ </head>
+ <body onload="boom();">
+ <iframe id="iframe" src="data:text/html,S"></iframe>
+ </body>
+</html>
diff --git a/dom/base/crashtests/593302-2.html b/dom/base/crashtests/593302-2.html
new file mode 100644
index 000000000..60e77d488
--- /dev/null
+++ b/dom/base/crashtests/593302-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <!-- This test should not leak. -->
+ <iframe src="data:text/html,
+ <script>
+ var elem = document.createElement('span');
+ document.mozSetImageElement('foo', elem);
+ elem.foo = document;
+ </script>"></iframe>
+ </body>
+</html>
diff --git a/dom/base/crashtests/595606-1.html b/dom/base/crashtests/595606-1.html
new file mode 100644
index 000000000..82cae2636
--- /dev/null
+++ b/dom/base/crashtests/595606-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="
+ document.body.removeChild(document.getElementById('x'));
+ document.documentElement.removeAttribute('class');">
+
+ <div id="x">
+ <div id="a">
+ <form id="a">
+ <select></select>
+ </form>
+ </div>
+ </div>
+
+ <select form="a"></select>
+ </body>
+</html>
diff --git a/dom/base/crashtests/595606-2.html b/dom/base/crashtests/595606-2.html
new file mode 100644
index 000000000..3cab264c0
--- /dev/null
+++ b/dom/base/crashtests/595606-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="
+ document.body.removeChild(document.getElementById('x'));
+ document.documentElement.removeAttribute('class');">
+
+ <div id="x">
+ <form id="a">
+ <select></select>
+ </form>
+ <form id="a">
+ <select></select>
+ </form>
+ </div>
+
+ <select form="a"></select>
+ </body>
+</html>
diff --git a/dom/base/crashtests/601247.html b/dom/base/crashtests/601247.html
new file mode 100644
index 000000000..6eb9f4657
--- /dev/null
+++ b/dom/base/crashtests/601247.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var x = document.createTextNode("x");
+x.__proto__ = localStorage;
+for (var p in x) {};
+
+</script>
diff --git a/dom/base/crashtests/603531.html b/dom/base/crashtests/603531.html
new file mode 100644
index 000000000..8243e462e
--- /dev/null
+++ b/dom/base/crashtests/603531.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.getElementById("f");
+ var frameWindow = frame.contentWindow;
+ document.body.removeChild(frame);
+ document.body.setUserData("x", frameWindow, null);
+ document.body.setUserData("x", "", null);
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/604262-1.html b/dom/base/crashtests/604262-1.html
new file mode 100644
index 000000000..bfc48fc2c
--- /dev/null
+++ b/dom/base/crashtests/604262-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var inputElem = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+inputElem.QueryInterface(Components.interfaces.imgIDecoderObserver);
+inputElem.onStartDecode(null);
+
+</script>
diff --git a/dom/base/crashtests/605672-1.svg b/dom/base/crashtests/605672-1.svg
new file mode 100644
index 000000000..b929b2669
--- /dev/null
+++ b/dom/base/crashtests/605672-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script>
+function boom()
+{
+ var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ fr.src = "data:text/html,X";
+ document.documentElement.appendChild(fr);
+ var docType = fr.contentDocument.implementation.createDocumentType(undefined, "", "");
+ document.removeChild(document.documentElement);
+ document.appendChild(docType);
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/dom/base/crashtests/606729-1.html b/dom/base/crashtests/606729-1.html
new file mode 100644
index 000000000..c81479c20
--- /dev/null
+++ b/dom/base/crashtests/606729-1.html
@@ -0,0 +1 @@
+<script async src="data:">0</script>
diff --git a/dom/base/crashtests/609560-1.xhtml b/dom/base/crashtests/609560-1.xhtml
new file mode 100644
index 000000000..7849c8db7
--- /dev/null
+++ b/dom/base/crashtests/609560-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function x()
+{
+ var p = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ frame.onload = y;
+ frame.src = "data:text/html,1";
+ document.body.appendChild(frame);
+ var frameRoot = frame.contentDocument.documentElement;
+
+ function y()
+ {
+ var frameDoc = frameRoot.ownerDocument;
+ frameRoot.appendChild(p);
+ var attr = frameDoc.createAttributeNS("http://www.w3.org/1999/xhtml", "u");
+ attr.w = {};
+ p.setAttributeNode(attr);
+ document.documentElement.removeAttribute("class");
+ }
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(x, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/610571-1.html b/dom/base/crashtests/610571-1.html
new file mode 100644
index 000000000..96dbc2271
--- /dev/null
+++ b/dom/base/crashtests/610571-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var frame1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame1.src = "data:text/html,1"; document.body.appendChild(frame1);
+ var frame2 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame2.src = "data:text/html,2"; document.body.appendChild(frame2);
+ var frame1doc = frame1.contentDocument;
+ var frame1root = frame1doc.documentElement;
+ frame1root.appendChild(frame2);
+ setTimeout(function() {
+ try {
+ frame2.contentDocument.q = frame1root.__lookupGetter__("nextSibling");
+ } catch(ex) {}
+ document.documentElement.removeAttribute("class");
+ }, 200);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/base/crashtests/612018-1.html b/dom/base/crashtests/612018-1.html
new file mode 100644
index 000000000..7f81422a7
--- /dev/null
+++ b/dom/base/crashtests/612018-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var input = document.createElement("input");
+ document.body.appendChild(input);
+ input.focus();
+ document.body.appendChild(input);
+ input.focus();
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/628599-1.html b/dom/base/crashtests/628599-1.html
new file mode 100644
index 000000000..09be38f1e
--- /dev/null
+++ b/dom/base/crashtests/628599-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var w;
+
+function b1()
+{
+ w = window.open("404.gif", "w2", "f");
+ setTimeout(b2, 1200);
+}
+
+function b2()
+{
+ w.close();
+ setTimeout(b3, 500);
+}
+
+function b3()
+{
+ w.location = "data:text/html,2";
+ document.body.appendChild(document.createTextNode("Done"));
+}
+
+</script>
+</head>
+<body>
+<div><button onclick="b1();">Start test</button></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/637116.html b/dom/base/crashtests/637116.html
new file mode 100644
index 000000000..01e8cd418
--- /dev/null
+++ b/dom/base/crashtests/637116.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function K(v) { return function() { return v; } }
+
+var errorProxy = new Proxy({}, {get: function() { throw new Error(); }});
+
+function boom()
+{
+ var focused = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ document.body.appendChild(focused);
+ var otherWin = window.open("data:text/html,1", "_blank", "width=200,height=200");
+ try { otherWin.history.replaceState(errorProxy, "title", "replaceState.html"); } catch(e) {}
+ focused.focus();
+ focused.addEventListener("foo", K(otherWin.applicationCache), false);
+ otherWin.close();
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<button onclick="boom();">If you have popups blocked, click here to start the leak test</button>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/637214-1.svg b/dom/base/crashtests/637214-1.svg
new file mode 100644
index 000000000..106428a29
--- /dev/null
+++ b/dom/base/crashtests/637214-1.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+ document.documentElement.appendChild(document.getElementById("a"));
+ setTimeout(function () {
+ document.getElementById("x").setAttribute("id", "m1");
+ document.documentElement.removeAttribute("class");
+ }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+ <path id="x"/>
+ <text>
+ <textPath xlink:href="#m1">Text</textPath>
+ <textPath xlink:href="#m1">Text</textPath>
+
+ </text>
+</g>
+
+</svg>
diff --git a/dom/base/crashtests/637214-2.svg b/dom/base/crashtests/637214-2.svg
new file mode 100644
index 000000000..4f5c92927
--- /dev/null
+++ b/dom/base/crashtests/637214-2.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+ document.documentElement.appendChild(document.getElementById("a"));
+ setTimeout(function () {
+ document.getElementById("x").removeAttribute("id");
+ document.documentElement.removeAttribute("class");
+ }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+ <path id="x"/>
+ <text>
+ <textPath xlink:href="#m1">Text</textPath>
+ <textPath xlink:href="#m1">Text</textPath>
+
+ </text>
+</g>
+
+</svg>
diff --git a/dom/base/crashtests/642022-1.html b/dom/base/crashtests/642022-1.html
new file mode 100644
index 000000000..b2bc59085
--- /dev/null
+++ b/dom/base/crashtests/642022-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+InstallTrigger.constructor.create(window).setTimeout(Array, 0);
+</script>
diff --git a/dom/base/crashtests/646184.html b/dom/base/crashtests/646184.html
new file mode 100644
index 000000000..ef34d41a6
--- /dev/null
+++ b/dom/base/crashtests/646184.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var w = f.contentWindow;
+ f.parentNode.removeChild(f);
+ w.localStorage;
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/658845-1.svg b/dom/base/crashtests/658845-1.svg
new file mode 100644
index 000000000..40a6a3167
--- /dev/null
+++ b/dom/base/crashtests/658845-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <use xlink:href="data:" />
+</svg>
diff --git a/dom/base/crashtests/666869.html b/dom/base/crashtests/666869.html
new file mode 100644
index 000000000..ac11f64e1
--- /dev/null
+++ b/dom/base/crashtests/666869.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var frameWin = f.contentWindow;
+ document.body.removeChild(f);
+ frameWin.performance;
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/667336-1.html b/dom/base/crashtests/667336-1.html
new file mode 100644
index 000000000..499f5a9ef
--- /dev/null
+++ b/dom/base/crashtests/667336-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("div").children.item(-1);
+</script>
diff --git a/dom/base/crashtests/675621-1.html b/dom/base/crashtests/675621-1.html
new file mode 100644
index 000000000..97a15be8d
--- /dev/null
+++ b/dom/base/crashtests/675621-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+<script>
+document.addEventListener("DOMSubtreeModified", function() {}, false);
+
+document.body.insertAdjacentHTML("afterbegin", "<p>foo");
+</script>
diff --git a/dom/base/crashtests/677194.html b/dom/base/crashtests/677194.html
new file mode 100644
index 000000000..a320219a2
--- /dev/null
+++ b/dom/base/crashtests/677194.html
@@ -0,0 +1,6 @@
+<script>
+function foo(o) {
+ o instanceof CSS2Properties;
+}
+foo({})
+</script>
diff --git a/dom/base/crashtests/679459.html b/dom/base/crashtests/679459.html
new file mode 100644
index 000000000..c3cbb0c7c
--- /dev/null
+++ b/dom/base/crashtests/679459.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var t = document.createTextNode("a");
+ document.body.appendChild(t);
+ var r1 = document.createRange();
+ r1.setEnd(t, 1);
+ var r2 = document.createRange();
+ r2.setEnd(t, 0);
+ r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/679689-1.html b/dom/base/crashtests/679689-1.html
new file mode 100644
index 000000000..aab88bbc3
--- /dev/null
+++ b/dom/base/crashtests/679689-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img crossorigin>
diff --git a/dom/base/crashtests/682463.html b/dom/base/crashtests/682463.html
new file mode 100644
index 000000000..735979e9f
--- /dev/null
+++ b/dom/base/crashtests/682463.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var j = document.createTextNode("j");
+ var r = document.createRange();
+ r.setEnd(j, 1);
+ j.splitText(0);
+ r.setEnd(j, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html> \ No newline at end of file
diff --git a/dom/base/crashtests/693212.xhtml b/dom/base/crashtests/693212.xhtml
new file mode 100644
index 000000000..6cc600d3b
--- /dev/null
+++ b/dom/base/crashtests/693212.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+ function boom() {
+ select = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+ text = document.body.childNodes[0];
+ select.setAttribute("onDOMSubtreeModified", "text.parentNode.removeChild(text);");
+ select.appendChild(text);
+ }
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+</html>
diff --git a/dom/base/crashtests/693811-1.html b/dom/base/crashtests/693811-1.html
new file mode 100644
index 000000000..e3629fbb2
--- /dev/null
+++ b/dom/base/crashtests/693811-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+
+var collection = document.images;
+var other = document.embeds;
+var options = document.createElement("select").options;
+collection.toString;
+options.selectedIndex;
+Object.getPrototypeOf(collection).item = {};
+other.toString;
+collection.toString;
+options.selectedIndex;
+options.toString;
+</script>
diff --git a/dom/base/crashtests/693811-2.html b/dom/base/crashtests/693811-2.html
new file mode 100644
index 000000000..858e66f4f
--- /dev/null
+++ b/dom/base/crashtests/693811-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+
+var collection = document.images;
+var other = document.embeds;
+var options = document.createElement("select").options;
+collection.toString;
+options.selectedIndex;
+Object.defineProperty(Object.getPrototypeOf(collection),
+ "item",
+ { value: {}, enumerable: true, configurable: true });
+other.toString;
+collection.toString;
+options.selectedIndex;
+options.toString;
+</script>
diff --git a/dom/base/crashtests/693811-3.html b/dom/base/crashtests/693811-3.html
new file mode 100644
index 000000000..6e5855e61
--- /dev/null
+++ b/dom/base/crashtests/693811-3.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("p").constructor = function(){};
+</script>
diff --git a/dom/base/crashtests/693894.html b/dom/base/crashtests/693894.html
new file mode 100644
index 000000000..23bf4a9c8
--- /dev/null
+++ b/dom/base/crashtests/693894.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var nodeList = document.getElementsByName("html");
+nodeList.__proto__ = null;
+nodeList.x;
+
+</script>
diff --git a/dom/base/crashtests/695867.html b/dom/base/crashtests/695867.html
new file mode 100644
index 000000000..4cba753f7
--- /dev/null
+++ b/dom/base/crashtests/695867.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+
+var nodeList = document.documentElement.childNodes;
+nodeList.__proto__ = null;
+var p = new Proxy({}, {getOwnPropertyDescriptor: function() {return nodeList}});
+Reflect.getOwnPropertyDescriptor(p, "x");
+
+</script>
diff --git a/dom/base/crashtests/697643.html b/dom/base/crashtests/697643.html
new file mode 100644
index 000000000..093e02ada
--- /dev/null
+++ b/dom/base/crashtests/697643.html
@@ -0,0 +1,5 @@
+<script>
+
+document.createElementNS('http://www.w3.org/1999/xhtml', 'select').options[0] = {};
+
+</script>
diff --git a/dom/base/crashtests/698974-1.html b/dom/base/crashtests/698974-1.html
new file mode 100644
index 000000000..b945c9a29
--- /dev/null
+++ b/dom/base/crashtests/698974-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createDocumentFragment().querySelector("div");
+</script>
diff --git a/dom/base/crashtests/700090-1.html b/dom/base/crashtests/700090-1.html
new file mode 100644
index 000000000..30479454f
--- /dev/null
+++ b/dom/base/crashtests/700090-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+ var t1 = document.createTextNode("123456 ");
+ mo.appendChild(t1);
+ document.body.appendChild(mo);
+ var t2 = document.createTextNode("x");
+ document.body.appendChild(t2);
+
+ var r1 = document.createRange();
+ r1.setEnd(t1, 7);
+ var r3 = document.createRange();
+ r3.setStart(t1, 7);
+
+ document.documentElement.offsetHeight;
+
+ var r2 = document.createRange();
+ r2.setStart(t1, 0);
+ r2.setEnd(t2, 0);
+ r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/700090-2.html b/dom/base/crashtests/700090-2.html
new file mode 100644
index 000000000..c6d5eb211
--- /dev/null
+++ b/dom/base/crashtests/700090-2.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+ var t1 = document.createTextNode("123456 ");
+ mo.appendChild(t1);
+ document.body.appendChild(mo);
+ var t2 = document.createTextNode("x");
+ document.body.appendChild(t2);
+
+ var r1 = document.createRange();
+ r1.setEnd(t1, 7);
+ var r3 = document.createRange();
+ r3.setStart(t1, 7);
+
+ document.documentElement.offsetHeight;
+
+ t1.splitText(t1.length);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/700512-worker.js b/dom/base/crashtests/700512-worker.js
new file mode 100644
index 000000000..fcb558fcf
--- /dev/null
+++ b/dom/base/crashtests/700512-worker.js
@@ -0,0 +1,7 @@
+onmessage = function(event) {
+ var blob = event.data;
+
+ blob.slice(1, 5);
+
+ postMessage("done");
+}
diff --git a/dom/base/crashtests/700512.html b/dom/base/crashtests/700512.html
new file mode 100644
index 000000000..49764e62b
--- /dev/null
+++ b/dom/base/crashtests/700512.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+ <script type="text/javascript">
+ var worker = new Worker("700512-worker.js");
+
+ worker.onmessage = function() {
+ document.documentElement.removeAttribute("class");
+ }
+
+ worker.postMessage(new Blob(["foo", "bar"]));
+ </script>
+</html>
diff --git a/dom/base/crashtests/706283-1.html b/dom/base/crashtests/706283-1.html
new file mode 100644
index 000000000..67b618e7f
--- /dev/null
+++ b/dom/base/crashtests/706283-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+
+window.requestAnimationFrame(null);
+
+</script>
diff --git a/dom/base/crashtests/709384.html b/dom/base/crashtests/709384.html
new file mode 100644
index 000000000..5e99e9c3c
--- /dev/null
+++ b/dom/base/crashtests/709384.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+ cancelRequestAnimationFrame(requestAnimationFrame(function() {}));
+ requestAnimationFrame(function() {});
+</script>
diff --git a/dom/base/crashtests/709954.html b/dom/base/crashtests/709954.html
new file mode 100644
index 000000000..a06b7715e
--- /dev/null
+++ b/dom/base/crashtests/709954.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+ setTimeout(function(){
+ document.documentElement.removeChild(document.body);
+ }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<input value="f" pattern="[">
+</body>
+
+</html>
diff --git a/dom/base/crashtests/713417-1.html b/dom/base/crashtests/713417-1.html
new file mode 100644
index 000000000..fed796988
--- /dev/null
+++ b/dom/base/crashtests/713417-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var w = f.contentWindow;
+ var d = w.document;
+ d.designMode = 'on';
+ var r = d.documentElement;
+ d.removeChild(r);
+ document.adoptNode(r);
+ f.parentNode.removeChild(f);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/713417-2.html b/dom/base/crashtests/713417-2.html
new file mode 100644
index 000000000..840b5d71a
--- /dev/null
+++ b/dom/base/crashtests/713417-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var w = f.contentWindow;
+ var d = w.document;
+ var range = d.createRange();
+ w.getSelection().removeAllRanges();
+ w.getSelection().addRange(range);
+ var r = d.documentElement;
+ d.removeChild(r);
+ w.getSelection().collapse(r,0);
+ document.adoptNode(r);
+ f.parentNode.removeChild(f);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/715056.html b/dom/base/crashtests/715056.html
new file mode 100644
index 000000000..214569b02
--- /dev/null
+++ b/dom/base/crashtests/715056.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var t1 = document.createTextNode("a");
+ var t2 = document.createTextNode("b");
+ document.appendChild(t1);
+ document.appendChild(t2);
+ var sel = window.getSelection();
+ sel.collapse(t2, 0)
+ document.normalize();
+ sel.removeAllRanges();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/729431-1.xhtml b/dom/base/crashtests/729431-1.xhtml
new file mode 100644
index 000000000..a9c93aa2e
--- /dev/null
+++ b/dom/base/crashtests/729431-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<script>
+<![CDATA[
+
+function boom()
+{
+ var d = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ d.setAttributeNS(null, "contenteditable", "true");
+ var s = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ d.appendChild(s);
+ document.documentElement.appendChild(d);
+
+ var textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+ var t1 = document.createTextNode("A");
+ textarea.appendChild(t1);
+ var t2 = document.createTextNode("B");
+ textarea.appendChild(t2);
+ document.documentElement.appendChild(textarea);
+
+ document.documentElement.offsetHeight;
+
+ d.removeChild(s);
+ textarea.removeChild(t2);
+ document.documentElement.appendChild(document.createTextNode(" C "));
+ document.documentElement.appendChild(t2);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<!-- no body -->
+
+</html>
diff --git a/dom/base/crashtests/741163-1.html b/dom/base/crashtests/741163-1.html
new file mode 100644
index 000000000..62262a949
--- /dev/null
+++ b/dom/base/crashtests/741163-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+
+var xhr = new XMLHttpRequest();
+xhr.onreadystatechange;
+
+</script>
diff --git a/dom/base/crashtests/745495.html b/dom/base/crashtests/745495.html
new file mode 100644
index 000000000..f513a33a8
--- /dev/null
+++ b/dom/base/crashtests/745495.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ document.body.appendChild(frame);
+ var frameScreen = frame.contentWindow.screen;
+ document.body.removeChild(frame);
+ frameScreen.top;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/752226-1.html b/dom/base/crashtests/752226-1.html
new file mode 100644
index 000000000..9c05388ff
--- /dev/null
+++ b/dom/base/crashtests/752226-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+var worker = new Worker("data:text/javascript,setTimeout(null)");
+</script>
diff --git a/dom/base/crashtests/752226-2.html b/dom/base/crashtests/752226-2.html
new file mode 100644
index 000000000..9d0aa1698
--- /dev/null
+++ b/dom/base/crashtests/752226-2.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("video").src = null
+</script>
diff --git a/dom/base/crashtests/766426.html b/dom/base/crashtests/766426.html
new file mode 100644
index 000000000..53b48ac9e
--- /dev/null
+++ b/dom/base/crashtests/766426.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var j = 0;
+ var a = document.getElementById("a");
+ var r = document.createRange();
+ r.setStart(a.childNodes[0], 0);
+ r.setEnd(a.childNodes[1], 0);
+
+ function f()
+ {
+ if (++j >= 2) {
+ document.removeEventListener("DOMNodeRemoved", f, false);
+ }
+ r.extractContents();
+ }
+
+ document.addEventListener("DOMNodeRemoved", f, false);
+
+ r.extractContents();
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a"><span><span></span></span>X</div>
+</body>
+</html>
diff --git a/dom/base/crashtests/771639.html b/dom/base/crashtests/771639.html
new file mode 100644
index 000000000..d32cb84d4
--- /dev/null
+++ b/dom/base/crashtests/771639.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+var root = document.documentElement;
+while(root.firstChild) { root.removeChild(root.firstChild); }
+var div = document.createElement("div");
+root.appendChild(div);
+
+document.addEventListener("DOMNodeRemoved", function() {
+ root.appendChild(document.createTextNode("some mutation"));
+}, false);
+
+var range = document.createRange();
+range.setStart(root, 0);
+range.setEnd(root, root.childNodes.length);
+range.deleteContents();
+</script>
diff --git a/dom/base/crashtests/786854.html b/dom/base/crashtests/786854.html
new file mode 100644
index 000000000..846741c08
--- /dev/null
+++ b/dom/base/crashtests/786854.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<table background=""></table>
+</body>
diff --git a/dom/base/crashtests/815043.html b/dom/base/crashtests/815043.html
new file mode 100644
index 000000000..d5cdd9359
--- /dev/null
+++ b/dom/base/crashtests/815043.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('x').dir = '';">
+
+<div><bdi><bdi id="x"><span></span></bdi></bdi></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/815276.html b/dom/base/crashtests/815276.html
new file mode 100644
index 000000000..8a691d668
--- /dev/null
+++ b/dom/base/crashtests/815276.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="((new DOMParser).parseFromString('<x/>', 'text/xml')).adoptNode(document.getElementById('v'));">
+<div id="v"><bdi>x</bdi></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/815477.html b/dom/base/crashtests/815477.html
new file mode 100644
index 000000000..c374632da
--- /dev/null
+++ b/dom/base/crashtests/815477.html
@@ -0,0 +1,15 @@
+<head dir=auto id=test1><ul id=test2>
+7. If no matching font face is within the "font-family" being processed by steps
+</ul>
+
+<h2 id=test3><p id=test5>* XHB7R%[+z^NvLp5 n$C
+<p id=test4>
+<script>
+var docElement = document.body;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+setTimeout('try { test5.appendChild(test4); } catch(e) {}', 50);
+try { test4.parentNode.removeChild(test4); test4 = test1; } catch(e) {}
+try { test4.insertBefore(test2, test4.firstChils); } catch(e) { }
+try { test2.textContent = test3.textContent; } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/815500.html b/dom/base/crashtests/815500.html
new file mode 100644
index 000000000..142e4feb7
--- /dev/null
+++ b/dom/base/crashtests/815500.html
@@ -0,0 +1,14 @@
+>><address id=test1> A,*/^㰞﷑ dq豑><script>
+function initCF() {
+try { test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "tt"); } catch(e) {}
+try { test2.setAttribute("dir", "auto"); } catch(e) {}
+setTimeout("CFcrash()", 253);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function editFuzz() {
+}
+function CFcrash() {
+try { test2.appendChild(test1); } catch(e) {}
+setTimeout('try { test2.setAttribute("dir", "&locale.dir;"); } catch(e) {}', 462);
+try { test1.innerHTML = "Z3 ᜃ 洿G0겨=#⨝ g B md^뛳 j # 鮪 8媾䝀 &#x30054;ᖾd煏됚M:㕑,i⼷ Geኔ ≴핛 "; } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/816253.html b/dom/base/crashtests/816253.html
new file mode 100644
index 000000000..6a1960823
--- /dev/null
+++ b/dom/base/crashtests/816253.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ window.onload = function() {
+ setInterval(
+ function next_step() {
+ var style = document.createElement('style');
+ style.innerHTML = "{ }";
+ document.getElementsByTagName("*")[ 7 ].appendChild(style);
+ window.dump('.');
+ }, 10);
+ }
+ </script>
+ </head>
+ <body>
+ <div id="console"></div>
+ <div id="parentDiv">
+ <div id="left-to-right" dir="auto" class="testElement">
+ <input type="text" value="מקור השם עברית">Test test test
+ </div>
+ </div>
+ <script id="des">
+ var el = document.getElementById("left-to-right");
+ document.defaultView.getComputedStyle(el, null).getPropertyValue('border-right-color');
+
+ document.getElementById("parentDiv").style.display = "none";
+ </script>
+
+ </body>
+</html>
diff --git a/dom/base/crashtests/819014.html b/dom/base/crashtests/819014.html
new file mode 100644
index 000000000..0e7c22c50
--- /dev/null
+++ b/dom/base/crashtests/819014.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta charset="utf-8">
+ </head>
+ <body>
+ <div>
+ <textarea id="right-to-left1" dir="auto" class="testElement">جناع</textarea>
+ <input type="text" id="right-to-left2" dir="auto" value="שלום">
+ </div>
+ <script type="text/javascript">
+ var test1=document.getElementById("right-to-left1");
+ var test2=document.getElementById("right-to-left2");
+ test2.appendChild(document.createTextNode("hello"));
+ setInterval(function() {
+ test1.appendChild(test2);
+ test2.parentNode.removeChild;
+ test1.innerHTML="goodbye";
+ }, 4);
+ </script>
+ </body>
+</html>
diff --git a/dom/base/crashtests/822691.html b/dom/base/crashtests/822691.html
new file mode 100644
index 000000000..8bc8eb831
--- /dev/null
+++ b/dom/base/crashtests/822691.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frameDoc = document.getElementById("f").contentDocument;
+
+ var confusedNode = frameDoc.createTextNode("y");
+ confusedNode.__proto__ = document.createTextNode("x");
+ confusedNode.setUserData("key", "data", null);
+ confusedNode.setUserData("key", "data", null);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/822723.html b/dom/base/crashtests/822723.html
new file mode 100644
index 000000000..e057d5b61
--- /dev/null
+++ b/dom/base/crashtests/822723.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var outer = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ outer.setAttribute("dir", "auto");
+ var inner = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ inner.appendChild(document.createTextNode("A"));
+ inner.appendChild(document.createTextNode("B"));
+ outer.appendChild(inner);
+ inner.setAttribute("dir", "ltr");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/824719.html b/dom/base/crashtests/824719.html
new file mode 100644
index 000000000..3749b0ec0
--- /dev/null
+++ b/dom/base/crashtests/824719.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<div id='console'></div>
+<div id='parentDiv'>
+<div id='right-to-left1' dir=auto class=testElement>
+<input type=text value="a">a
+</div>
+<div id='right-to-left2' dir=auto class=testElement>
+</div>
+</div>
+
+<script type="text/javascript">
+
+document.getElementById("right-to-left2").appendChild(document.createElement("p"))
+var test5=document.getElementById("right-to-left1")
+var test6=document.getElementById("console").appendChild(document.createElement("dl"))
+
+test6.appendChild(document.createElement("img"))
+
+test5.parentNode.removeChild(test5)
+test5.innerHTML=''
+test5.appendChild(test6.cloneNode(true))
+</script>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/827190.html b/dom/base/crashtests/827190.html
new file mode 100644
index 000000000..d2b55e61c
--- /dev/null
+++ b/dom/base/crashtests/827190.html
@@ -0,0 +1,13 @@
+<noframes dir=auto id=test4></noframes><vbox id=test5>K<csaction id=test3><script>
+function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.nextSibling); walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.parentNode.removeChild(a[key].domNode); }}
+function crash() {
+try { test1 = document.createElementNS("http://www.w3.org/2000/svg", "text"); } catch(e) {}
+try { test2 = test3.cloneNode(true); } catch(e) {}
+setTimeout("try { clear(); } catch(e) {}", 500);
+try { test1.appendChild(test5); } catch(e) {}
+try { test2.appendChild(test1); } catch(e) {}
+try { test4.appendChild(test2); } catch(e) {}
+try { test5.innerHTML = ""; } catch(e) {}
+}
+document.addEventListener("DOMContentLoaded", crash, false);
+</script> \ No newline at end of file
diff --git a/dom/base/crashtests/828054.html b/dom/base/crashtests/828054.html
new file mode 100644
index 000000000..ae5b8d35a
--- /dev/null
+++ b/dom/base/crashtests/828054.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var outer = document.createElement("div");
+ outer.setAttribute("dir", "auto");
+ var inner = document.createElement("div");
+ inner.appendChild(document.createTextNode("A"));
+ outer.appendChild(inner);
+ inner.setAttribute("dir", "auto");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/828903-iframe.html b/dom/base/crashtests/828903-iframe.html
new file mode 100644
index 000000000..dc40c45d6
--- /dev/null
+++ b/dom/base/crashtests/828903-iframe.html
@@ -0,0 +1,46 @@
+<html>
+<script>
+function start() {
+try{o33=document.documentElement;}catch(e){}
+try{o1.appendChild;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.id = 'id36'}catch(e){}
+try{o33.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+try{o51=o33.ownerDocument.getElementById('id36').contentDocument;}catch(e){}
+try{o579=document.documentElement;}catch(e){}
+try{tmp.id = 'id421'}catch(e){}
+try{o619=document.getElementById('id421').contentDocument;}catch(e){}
+try{o622=window.document.getElementById('id421').contentWindow.document;}catch(e){}
+try{o875.setAttributeNS(null,'letter-spacing','normal');}catch(e){}
+try{o884=document.createElementNS('http://www.w3.org/2000/svg','set');;}catch(e){}
+try{o887=document.createElementNS('http://www.w3.org/2000/svg','desc');;}catch(e){}
+try{o884.appendChild(o887);}catch(e){}
+try{o887=document.documentElement;}catch(e){}
+try{o1041=o622.createElement('bdi');;}catch(e){}
+window.setTimeout('start2()',100);
+}
+function start2() {
+try{o1042=document.createElement('input');;}catch(e){}
+try{o1043=o51.createElement('input');;}catch(e){}
+try{o884.appendChild(o1043);}catch(e){}
+try{o1053=o1043.previousElementSibling;}catch(e){}
+try{o1067=o619.createElement('blockquote');;}catch(e){}
+try{o1062.appendChild(o1067);}catch(e){}
+try{o1074=o619.createElement('ruby');;}catch(e){}
+try{o1067.appendChild(o1074);}catch(e){}
+try{document.body.appendChild(o1041);}catch(e){}
+try{o1041.appendChild(o1042);}catch(e){}
+try{o1095=o51.createTextNode(unescape('%uff0f%u017f%u0390%ufffa%u2073%uff4d%uDF53%u0261'));;}catch(e){}
+try{o1053.appendChild(o1095);}catch(e){}
+try{o1041.appendChild(o1043.parentNode);}catch(e){}
+try{o1042.appendChild(o1067);}catch(e){}
+try{o1053=null;}catch(e){}
+try{o1095=null;}catch(e){}
+try{for(var xrn in o884.childNodes) o884.removeChild(o884.childNodes[xrn]);}catch(e){}
+//fuzzer.gc();
+location.reload();
+}
+</script>
+<body onload="start()">
+</body>
+</html>
diff --git a/dom/base/crashtests/828903.html b/dom/base/crashtests/828903.html
new file mode 100644
index 000000000..1a5a4d31f
--- /dev/null
+++ b/dom/base/crashtests/828903.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 828903</title>
+<script>
+function reload() {
+ this.location.reload();
+}
+// Run the test for 2 seconds
+setTimeout(function() {
+ document.documentElement.removeChild(document.body);
+ document.documentElement.className = "";
+ }, 2000);
+</script>
+</head>
+<body onload="document.body.getBoundingClientRect()">
+
+<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/829428.html b/dom/base/crashtests/829428.html
new file mode 100644
index 000000000..4cab24d87
--- /dev/null
+++ b/dom/base/crashtests/829428.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('inner').dir = 'auto';">
+<div dir="auto"><div id="inner"><svg></svg></div></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/830098.html b/dom/base/crashtests/830098.html
new file mode 100644
index 000000000..da9d7f0d2
--- /dev/null
+++ b/dom/base/crashtests/830098.html
@@ -0,0 +1,14 @@
+<canvas dir=auto><p id=test1>
+
+
+nt/b|+K E:</p>
+ <svg>
+ <defs id=test2>~ N LRWue`N6g J`NfT Ai0 BG q QPX6 ~ #A?ORD
+ <span><metadata id=test4><use id=test3>>>><script>
+var docElement = document.body ? document.body : document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test1.parentNode.removeChild(test1); } catch(e) {}
+try { test2.innerHTML = ''; } catch(e) {}
+try { test3.outerHTML = test4.outerHTML; } catch(e) {}
+}</script> \ No newline at end of file
diff --git a/dom/base/crashtests/831287.html b/dom/base/crashtests/831287.html
new file mode 100644
index 000000000..3cd77fd21
--- /dev/null
+++ b/dom/base/crashtests/831287.html
@@ -0,0 +1,11 @@
+<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas>
+
+><script>
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+test1.appendChild(test4);
+test1.setAttribute("dir", "foopy");
+test1.appendChild(c);
+test4.textContent = test2.outerHTML;
+c.appendChild(test3);
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/832644.html b/dom/base/crashtests/832644.html
new file mode 100644
index 000000000..29429b8df
--- /dev/null
+++ b/dom/base/crashtests/832644.html
@@ -0,0 +1,8 @@
+<x6 id=test1>><bdi id=test2><fieldset id=test3>>ohVG l0ci * |X5SEX :GdK5i2rC#sdnwJv0%O{QF Lh>>><ol id=test4><script>
+var docElement = document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test2.setAttribute("dir", "auto"); } catch(e) {}
+try { test3.innerHTML = test4.innerHTML; } catch(e) {}
+setTimeout('docElement.insertBefore(test1, docElement.firstChild);', 2);
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/836890.html b/dom/base/crashtests/836890.html
new file mode 100644
index 000000000..a75fa3c45
--- /dev/null
+++ b/dom/base/crashtests/836890.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var outer = document.createElement("span");
+ var inner = document.createElement("span");
+ outer.dir = "auto";
+ outer.appendChild(inner);
+ inner.appendChild(document.createTextNode("x"));
+ inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/838489-1.html b/dom/base/crashtests/838489-1.html
new file mode 100644
index 000000000..ed10dff5a
--- /dev/null
+++ b/dom/base/crashtests/838489-1.html
@@ -0,0 +1,11 @@
+><bdi id=test>
+<xmp></xmp><font>><span><br>><keygen>><script>
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function editFuzz() {
+document.designMode = "on";
+try { document.execCommand("indent", false, true) } catch(e) {}
+}
+function CFcrash() {
+setTimeout("try { editFuzz(); } catch(e) {}", 0);
+try { test.setAttribute("dir", "&locale.dir;"); } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/838489-2.html b/dom/base/crashtests/838489-2.html
new file mode 100644
index 000000000..e8df81a5c
--- /dev/null
+++ b/dom/base/crashtests/838489-2.html
@@ -0,0 +1,16 @@
+<foo id=test1>>><body id=test2 '><bdi id=test3><keygen>
+<test><script>
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {}
+try { docElement.appendChild(test4); } catch(e) {}
+try { test5 = test3.cloneNode(true); } catch(e) {}
+try { test5.setAttribute("dir", "invalid"); } catch(e) {}
+try { docElement.appendChild(test5); } catch(e) {}
+setTimeout("CFcrash()", 0);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+try { test1.appendChild(test4); } catch(e) {}
+try { document.adoptNode(test2); } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/841205.html b/dom/base/crashtests/841205.html
new file mode 100644
index 000000000..4de533a88
--- /dev/null
+++ b/dom/base/crashtests/841205.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var b = document.createElement('bdi');
+ var c = document.createElement('div');
+ var d = document.createElement('div');
+
+ b.appendChild(c);
+ c.appendChild(d);
+ b.removeChild(c);
+ d.appendChild(b);
+ document.createElement('div').appendChild(c);
+ b.appendChild(document.createElement('div'));
+
+ b.setAttribute('dir', "auto");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/844404.html b/dom/base/crashtests/844404.html
new file mode 100644
index 000000000..9022837bf
--- /dev/null
+++ b/dom/base/crashtests/844404.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ d.setAttribute('dir', "auto");
+ c.setAttribute('dir', "auto");
+ d.removeAttribute('dir');
+ c.removeAttribute('dir');
+ b.setAttribute('dir', "auto");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="a" dir="auto"><div id="b"><div id="c"><div id="d"></div></div></div></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/845093-1.html b/dom/base/crashtests/845093-1.html
new file mode 100644
index 000000000..47658850f
--- /dev/null
+++ b/dom/base/crashtests/845093-1.html
@@ -0,0 +1,10 @@
+<body dir=auto> u
+<script>
+function initCF() {
+setTimeout("CFcrash()", 284);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+try { document.designMode = 'on'; document.execCommand("InsertHTML", false, "world"); document.designMode = 'off'; } catch(e) {}
+try { document.designMode = 'on'; document.execCommand("inserthtml", false, "<span><div>"); } catch(e) {}
+}</script>>
diff --git a/dom/base/crashtests/845093-2.html b/dom/base/crashtests/845093-2.html
new file mode 100644
index 000000000..2d513449a
--- /dev/null
+++ b/dom/base/crashtests/845093-2.html
@@ -0,0 +1,7 @@
+><bdi id=test1><refa id=test2>&#xf921;>></bdi>><h1 id=test3><script>
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+test1.setAttribute("dir", "invalid");
+test2.textContent = " &#xf851;S ";
+test3.appendChild(test1);
+}</script>
diff --git a/dom/base/crashtests/847127.html b/dom/base/crashtests/847127.html
new file mode 100644
index 000000000..4d78893d8
--- /dev/null
+++ b/dom/base/crashtests/847127.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var outer = document.createElement("span");
+ outer.dir = "auto";
+ var inner = document.createElement("span");
+ outer.appendChild(inner);
+ inner.appendChild(document.createTextNode("\u202B"));
+ inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/849601.html b/dom/base/crashtests/849601.html
new file mode 100644
index 000000000..0d09ebf79
--- /dev/null
+++ b/dom/base/crashtests/849601.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function addEmptyMutationObserver()
+{
+ var m = new MutationObserver(function () {});
+ var e = document.createElement('i');
+ m.observe(e, { childList: true });
+}
+
+function addPointlessMutationListener()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ a.appendChild(document.createTextNode("1"));
+
+ function f() {
+ window.removeEventListener("DOMSubtreeModified", f, false);
+ a.insertAdjacentHTML("afterBegin", "<span></span>");
+ };
+
+ window.addEventListener("DOMSubtreeModified", f, false);
+}
+
+function boom()
+{
+ addEmptyMutationObserver();
+ addPointlessMutationListener();
+ document.body.outerHTML = "";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/849727.html b/dom/base/crashtests/849727.html
new file mode 100644
index 000000000..9b72b6c02
--- /dev/null
+++ b/dom/base/crashtests/849727.html
@@ -0,0 +1,9 @@
+<fieldset id=test1>>>>><figure>w.)+</figure>>.c34::-moz-page-sequence { outline-color: invert }<script>
+function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.parentNode.removeChild(a[key].domNode); }}
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+setTimeout("try { clear(); } catch(e) {}", 1419);
+try { test1.setAttribute("dir", "auto"); } catch(e) {}
+try { test1.setAttribute("dir", "rtl"); } catch(e) {}
+try { test1.innerHTML = "j, -wv g yys~*hFchDO*u!c{ XRe@Ieo%[8 M3DZu JoymuI^AjosAx#}A6fUb7M^{lNSX FZSa 15Zr?mAS/ KLc Ip`yT^ZHw!6T-zbYi)24w/6:a; [5 l)T^DOw5T{H O&% kq m6 &HlP"; } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/849732.html b/dom/base/crashtests/849732.html
new file mode 100644
index 000000000..af084e417
--- /dev/null
+++ b/dom/base/crashtests/849732.html
@@ -0,0 +1,18 @@
+<url id=test1></url>><listing id=test2>
+A[]@q
+<root id=test3><bdi dir=ltr id=test4><script>
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { test5 = document.createElementNS("http://www.w3.org/2000/svg", "symbol"); } catch(e) {}
+setTimeout("CFcrash()", 231);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+try { if (test1 != docElement) { test1.parentNode.removeChild(test1); test1 = test4; }} catch(e) {}
+try { if (test1 != docElement) { test1.parentNode.removeChild(test1); }} catch(e) {}
+try { test4.appendChild(test3); } catch(e) {}
+try { test3.appendChild(test2); } catch(e) {}
+try { test4.setAttribute("dir", "invalid"); } catch(e) {}
+setTimeout('try { test5.appendChild(test4); } catch(e) {}', 343);
+try { test2.innerHTML = "W?bj; ![#`A`#Mn$1r+cn OwS56 =@jQZU Ua.[d 4g07!6pZzjN ~4P 1C0_# E#Ak/OYXQ46F%7)^KI m-9:`u2^yx R ,yv04!`L)x3V A5K*&NK!Z qnXt!`I 4i|i=eE?VI=^&lx:F hI2=t+AH)A` | 3wWxDv0eU"; } catch(e) {}
+}</script>> \ No newline at end of file
diff --git a/dom/base/crashtests/851353-1.html b/dom/base/crashtests/851353-1.html
new file mode 100644
index 000000000..ac5d772b6
--- /dev/null
+++ b/dom/base/crashtests/851353-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <meta charset="UTF-8">
+ <script>
+ function start() {
+ var doc = document.getElementsByTagName("iframe")[0].contentDocument;
+ var vid = doc.getElementsByTagName("video")[0];
+
+ function runnable() {
+ // The doc.write forces us to recreate doc's body.
+ doc.write("Hello, world");
+ doc.body.appendChild(vid);
+ document.documentElement.removeAttribute("class");
+ }
+
+ doc.open();
+ setTimeout(runnable, 0);
+ }
+ </script>
+</head>
+<body onload='start()'>
+ <iframe src="data:text/html,<meta charset=UTF-8><body><video src=http://localhost:8080/ controls=true loop=true autoplay=true autobuffer=false></video>"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/852381.html b/dom/base/crashtests/852381.html
new file mode 100644
index 000000000..7e8dd47f8
--- /dev/null
+++ b/dom/base/crashtests/852381.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var z = document.createElement("legend");
+ document.documentElement.appendChild(z);
+ z.style.display = "table-column-group";
+ window.find("?");
+ z.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/863950.html b/dom/base/crashtests/863950.html
new file mode 100644
index 000000000..42303a509
--- /dev/null
+++ b/dom/base/crashtests/863950.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="position: fixed;">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var cp = document.caretPositionFromPoint(0, 1);
+ document.documentElement.removeChild(document.body);
+ cp.getClientRect();
+}
+
+</script>
+</head>
+
+<body style="margin: 0;" onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/864448.html b/dom/base/crashtests/864448.html
new file mode 100644
index 000000000..fdb1a75ea
--- /dev/null
+++ b/dom/base/crashtests/864448.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.setUserData('key', {}, null);
+
+ // Depending on the pref bidi.direction, one of these will hit the page scrollbar.
+ window.cpRight = document.caretPositionFromPoint(window.innerWidth - 1, 0);
+ window.cpLeft = document.caretPositionFromPoint(0, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div style="height: 50000px;"></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/886213.html b/dom/base/crashtests/886213.html
new file mode 100644
index 000000000..9cba893f3
--- /dev/null
+++ b/dom/base/crashtests/886213.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ // This shouldn't leak
+ var frame = document.getElementById("f");
+ var frameWin = frame.contentWindow;
+ document.body.removeChild(frame);
+ frameWin.navigator;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html;charset=utf-8,1"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/898906.html b/dom/base/crashtests/898906.html
new file mode 100644
index 000000000..12f744109
--- /dev/null
+++ b/dom/base/crashtests/898906.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var plug = navigator.plugins[0];
+var mime = plug[0];
+// This shouldn't leak.
+mime.expando = true;
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/90613-1.html b/dom/base/crashtests/90613-1.html
new file mode 100644
index 000000000..de60573cc
--- /dev/null
+++ b/dom/base/crashtests/90613-1.html
@@ -0,0 +1,7 @@
+<html>
+<body onload="this.focus();" onfocus="document.getElementById('foo').focus();"
+onblur="/*alert('hello');*/this.focus();">
+<input type="text" id="foo">
+</body>
+</html>
+
diff --git a/dom/base/crashtests/930250.html b/dom/base/crashtests/930250.html
new file mode 100644
index 000000000..cf2c15e9e
--- /dev/null
+++ b/dom/base/crashtests/930250.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<nobr>
+<h4 contenteditable="true">
+<iframe></iframe>
+<applet></applet>
+<nobr>
diff --git a/dom/base/crashtests/942979.html b/dom/base/crashtests/942979.html
new file mode 100644
index 000000000..03814c9f7
--- /dev/null
+++ b/dom/base/crashtests/942979.html
@@ -0,0 +1,42 @@
+<html>
+<head></head>
+<body>
+<script>
+var QNBABBAH=document.createElement('ROTFL');
+
+QNBABBAH.addEventListener('DOMNodeRemoved',function EventHandlerEventHandlerIMQFGDGL()
+{
+ QNBABBAH.normalize();
+}, false);
+
+var MBHOMIBK=document.createElement('whatever');
+QNBABBAH.appendChild(MBHOMIBK);
+
+var BKDKEDBI=document.createElement('whatever');
+MBHOMIBK.appendChild(BKDKEDBI);
+
+var QQFOJBAM=document.createElement('whatever');
+BKDKEDBI.appendChild(QQFOJBAM);
+
+var JNCNIPON=document.createElement('whatever');
+QQFOJBAM.appendChild(JNCNIPON);
+var a=document.createTextNode('AAAA');
+
+JNCNIPON.addEventListener('DOMNodeInserted',function EventHandlerEventHandlerGFNKONKK()
+{
+ JNCNIPON.insertAdjacentHTML('afterbegin','.');
+
+}, false);
+
+JNCNIPON.appendChild(a);
+
+var CACEQGDA=document.createElement('whatever2');
+
+CACEQGDA.addEventListener('DOMSubtreeModified',function EventHandlerEventHandlerMOOLBGNC(){
+
+}, false);
+
+JNCNIPON.innerHTML = 'ALBERTDAJEDUPY';
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/973401.html b/dom/base/crashtests/973401.html
new file mode 100644
index 000000000..070548edd
--- /dev/null
+++ b/dom/base/crashtests/973401.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.createElement("iframe");
+ document.body.appendChild(frame);
+ var frameLoc = frame.contentWindow.location;
+ document.body.removeChild(frame)
+ frameLoc.origin;
+ document.documentElement.removeAttribute('class');
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/978646.html b/dom/base/crashtests/978646.html
new file mode 100644
index 000000000..09274ed16
--- /dev/null
+++ b/dom/base/crashtests/978646.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.styleSheetSets.expando = null;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
new file mode 100644
index 000000000..a0739f074
--- /dev/null
+++ b/dom/base/crashtests/crashtests.list
@@ -0,0 +1,211 @@
+load 43040-1.html
+load 90613-1.html
+load 116848-1.html
+load 149320-1.html
+load 205225-1.html
+load 231475-1.html
+load 244933-1.html
+load 275912-1.html
+load 293388-1.html
+load 308120-1.xul
+load 324871-1.html
+load 325730-1.html
+load 326618-1.html
+load 326646-1.html
+load 326778-1.xul
+load 326865-1.html
+load 327571-1.html
+load 327694.html
+load 327695-1.html
+load 329481-1.xhtml
+load 330925-1.xhtml
+load 336381-1.xhtml
+load 336715-1.xhtml
+load 338391-1.xhtml
+load 338674-1.xhtml
+load 340733-1.html
+load 343730-1.xhtml
+load 343850-1.xhtml
+load 343889-1.html
+load 344434-1.xhtml
+load 344882-1.html
+load 345837-1.xhtml
+load 346381-1.html
+load 348049-1.xhtml
+load 349355-1.html
+load 354645-1.xul
+load 359432-1.xhtml
+load 360599-1.html
+load 366200-1.xhtml
+load 369219-1.xhtml
+load 369413-1.html
+load 371124-1.html
+load 371124-2.html
+load 371466-1.xhtml
+load 372554-1.html
+load 375399-1.html
+load 377360-1.xhtml
+load 377960-1.html
+load 377960-2.html
+load 384663-1.html
+load 386000-1.html
+load 386794-1.html
+load 387460-1.html
+load 395469-1.xhtml
+load 395469-2.xhtml
+load 398088-1.xul
+skip load 399712-1.html # sporadically times out (bug 473680)
+load 400763-1.html
+load 401993-1.html
+load 404869-1.xul
+load 407818.html
+load 410860-1.xml
+load 411882-1.xhtml
+load 416734-1.html
+load 417852-1.html
+load 418928-1.html
+load 420620-1.html
+load 424276-1.html
+load 426987-1.html
+load 439206-1.html
+load 443538-1.svg
+load 448615-1.html
+load 450383-1.html
+load 450385-1.html
+skip load 458637-1.html # sporadically times out (bug 473680)
+load 462947.html
+load 467392.html
+load 472593-1.html
+load 473284.xul
+load 474041-1.svg
+load 476526.html
+load 483818-1.html
+load 490760-1.xhtml
+load 493281-1.html
+load 493281-2.html
+load 494810-1.html
+load 499006-1.html
+load 499006-2.html
+load 502617.html
+load 504224.html
+load 509536-1.html
+load 522516-1.html
+load 529670.html
+load 535926-1.html
+load 543645.html
+load 551631-1.html
+load 552651.html
+load 554230-1.xhtml
+load 558973.html
+load 561981-1.html
+load 561981-2.html
+load 564079-1.html
+load 564114.html
+load 565125-1.html
+load 575462.svg
+load 582601.html
+load 590395-1.html
+load 593302-1.html
+load 593302-2.html
+load 595606-1.html
+load 595606-2.html
+load 601247.html
+load 603531.html
+load 604262-1.html
+load 605672-1.svg
+load 606729-1.html
+load 609560-1.xhtml
+load 610571-1.html
+load 612018-1.html
+load 628599-1.html
+load 637116.html
+load 637214-1.svg
+load 637214-2.svg
+load 642022-1.html
+load 646184.html
+load 658845-1.svg
+load 666869.html
+load 667336-1.html
+load 675621-1.html
+load 677194.html
+load 679459.html
+load 679689-1.html
+load 682463.html
+load 693212.xhtml
+load 693811-1.html
+load 693811-2.html
+load 693811-3.html
+load 693894.html
+load 695867.html
+load 697643.html
+load 698974-1.html
+load 700090-1.html
+load 700090-2.html
+load 700512.html
+load 706283-1.html
+load 709384.html
+load 709954.html
+load 713417-1.html
+load 713417-2.html
+load 715056.html
+load 729431-1.xhtml
+load 741163-1.html
+load 745495.html
+load 752226-1.html
+load 752226-2.html
+load 766426.html
+load 771639.html
+load 786854.html
+load 815043.html
+load 815276.html
+load 815477.html
+load 815500.html
+load 816253.html
+load 819014.html
+load 822691.html
+load 822723.html
+load 824719.html
+load 827190.html
+load 828054.html
+load 828903.html
+load 829428.html
+load 830098.html
+load 831287.html
+load 832644.html
+load 836890.html
+load 838489-1.html
+load 838489-2.html
+load 841205.html
+load 844404.html
+load 845093-1.html
+load 845093-2.html
+load 847127.html
+load 849601.html
+load 849727.html
+load 849732.html
+load 851353-1.html
+load 852381.html
+load 863950.html
+load 864448.html
+load 886213.html
+load 898906.html
+load 930250.html
+load 942979.html
+load 973401.html
+load 978646.html
+pref(dom.webcomponents.enabled,true) load 1024428-1.html
+load 1026714.html
+pref(dom.webcomponents.enabled,true) load 1027461-1.html
+pref(dom.webcomponents.enabled,true) load 1029710.html
+load 1154598.xhtml
+load 1157995.html
+load 1158412.html
+load 1181619.html
+load structured_clone_container_throws.html
+HTTP(..) load xhr_abortinprogress.html
+load xhr_empty_datauri.html
+load xhr_html_nullresponse.html
+load 1230422.html
+load 1251361.html
+load 1304437.html
+pref(clipboard.autocopy,true) load 1385272-1.html
diff --git a/dom/base/crashtests/structured_clone_container_throws.html b/dom/base/crashtests/structured_clone_container_throws.html
new file mode 100644
index 000000000..c92c6f4ae
--- /dev/null
+++ b/dom/base/crashtests/structured_clone_container_throws.html
@@ -0,0 +1,9 @@
+<iframe></iframe>
+<script>
+try { frames[0].history.pushState({ dummy: function() {} }, ''); }
+catch (e) {}
+var doc = frames[0].document;
+var s = doc.createElement("script");
+s.textContent = "1";
+doc.body.appendChild(s);
+</script>
diff --git a/dom/base/crashtests/xhr_abortinprogress.html b/dom/base/crashtests/xhr_abortinprogress.html
new file mode 100644
index 000000000..5345e9bf2
--- /dev/null
+++ b/dom/base/crashtests/xhr_abortinprogress.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset=UTF-8>
+<script>"use strict";
+(function(){
+ var req = new XMLHttpRequest();
+ req.open('GET', '?' + Date.now());
+ req.responseType = 'moz-blob';
+ var b = null;
+ req.onprogress = function(e) {
+ b = req.response;
+ };
+ req.onreadystatechange = function(e) {
+ if (req.readyState == 3) {
+ req.abort();
+ }
+ if (req.readyState == 4) {
+ document.documentElement.removeAttribute('class');
+ }
+ };
+ req.send();
+})();
+</script>
diff --git a/dom/base/crashtests/xhr_empty_datauri.html b/dom/base/crashtests/xhr_empty_datauri.html
new file mode 100644
index 000000000..77988cfe2
--- /dev/null
+++ b/dom/base/crashtests/xhr_empty_datauri.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html class="reftest-wait"><meta charset=utf-8>
+<script>
+var xhr=new XMLHttpRequest();xhr.open("GET","data:,");xhr.responseType='blob';xhr.onloadend=function(){document.documentElement.removeAttribute('class');};xhr.send();
+</script>
diff --git a/dom/base/crashtests/xhr_html_nullresponse.html b/dom/base/crashtests/xhr_html_nullresponse.html
new file mode 100644
index 000000000..47c85db9b
--- /dev/null
+++ b/dom/base/crashtests/xhr_html_nullresponse.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var xhr=new XMLHttpRequest();xhr.open("GET",window.location);xhr.overrideMimeType("text/html");xhr.onprogress=function(){if(xhr.readyState!=3)return;xhr.abort();document.documentElement.removeAttribute('class');};xhr.onabort=function(){xhr.responseText;};xhr.send();
+</script>